WordPress Plugin Vulnerabilities

All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting (XSS)

Description

The All in One SEO Pack WordPress plugin was affected by a Unauthenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Affects Plugins

Plugin icon
all-in-one-seo-pack
Fixed in 2.3.8

References

URL
https://web.archive.org/web/20161019215603/https://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/
URL
https://www.wordfence.com/blog/2016/07/new-xss-vulnerability-all-in-one-seo-pack/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Panagiotis Vagenas of Wordfence
Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
42a98395-e4e4-47a5-b758-2b76b7c4885a

Timeline

Publicly Published
2016-07-13 (about 9 years ago)
Added
2016-07-19 (about 9 years ago)
Last Updated
2020-04-13 (about 5 years ago)

Other

Published
Title
Published
2024-03-25
Title
Gratisfaction < 4.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-08
Title
Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-12-12
Title
a3 Lazy Load < 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-23
Title
Small Package Quotes – Unishippers Edition < 2.4.10 - Reflected Cross-Site Scripting
Published
2022-04-25
Title
Content Egg < 5.3.1 - Reflected Cross-Site Scripting