CVE-2024-2165: SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting
The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2165?
CVE-2024-2165 is considered a medium severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2024-2165?
To remediate CVE-2024-2165, update the SEOPress On-site SEO plugin for WordPress to the latest version beyond 7.5.2.1.
Who is affected by CVE-2024-2165?
CVE-2024-2165 affects all versions of the SEOPress On-site SEO plugin for WordPress up to and including version 7.5.2.1.
What kind of attack can CVE-2024-2165 enable?
CVE-2024-2165 enables authenticated attackers to execute stored cross-site scripting (XSS) attacks.
What role do users need to exploit CVE-2024-2165?
Users need to have author-level access or higher to exploit CVE-2024-2165.