WordPress Plugin Vulnerabilities

SEO Redirection < 2.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

Description

The plugin did not sanitise the referer link from requests before displaying them in the 'Settings > SEO Redirection > Redirection History' page. This result in a Store dCross-Site Scripting (XSS) issue

Proof of Concept

Affects Plugins

Plugin icon
seo-redirection
Fixed in 2.3

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Submitter
SecuBeastTeam
Verified
No
WPVDB ID
2e242008-3688-455c-821c-541a6ee0fedc

Timeline

Publicly Published
2014-12-15 (about 11 years ago)
Added
2014-12-15 (about 11 years ago)
Last Updated
2021-01-29 (about 5 years ago)

Other

Published
Title
Published
2024-05-21
Title
LuckyWP Table of Contents < 2.1.5 - Contributor+ Stored XSS
Published
2024-10-16
Title
WP ULike < 4.7.5 - Admin+ Stored XSS via Widgets
Published
2025-02-28
Title
Currency Switcher for WooCommerce < 2.16.3 - Reflected Cross-Site Scripting
Published
2023-01-20
Title
User Registration < 2.3.1 - Admin+ Stored XSS
Published
2023-10-02
Title
Notice Bar < 3.1.1 - Contributor+ Stored XSS