WP SEO Press < 7.3 – Admin+ Stored XSS | CVE 2023-6290 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Proof of Concept

1. Navigate to http://vulnerable-site.tld/wp-admin/admin.php?page=seopress-titles.
2. Input the following payload into Separator: <script>alert('HackedbySandy')</script>.
3. Submit the form, and edit a regular post to notice the JavaScript payload being executed.

Affects Plugins

Fixed in 7.3

References

CVE

YouTube Video

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Sandeep Vishwakarma

Submitter

Sandeep Vishwakarma

Verified

Yes

WPVDB ID

78a13958-cd12-4ea8-b326-1e3184da970b

Timeline

Publicly Published

2023-12-26 (about 2 years ago)

Added

2023-12-26 (about 2 years ago)

Last Updated

2023-12-26 (about 2 years ago)

Other

Published

Title

Published

2022-12-28

Title

Collapse-O-Matic < 1.8.3 - Contributor+ Stored XSS

Published

2024-04-25

Title

PopupAlly < 2.1.2 - Admin+ Stored XSS

Published

2025-02-02

Title

WP Church Center <= 1.3.3 - Reflected Cross-Site Scripting

Published

2023-05-10

Title

Order Your Posts Manually <= 2.2.5 - Reflected XSS

Published

2023-09-25

Title

WoodMart < 7.2.5 - Reflected XSS