WordPress Plugin Vulnerabilities
SEO Redirection < 6.4 - Authenticated Reflected Cross-Site Scripting (XSS)
Description
The setting page of the plugin is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.
Timeline (WPScanTeam)
January 29th, 2021 - Report received & Confirmed & Escalated to WordPress plugins Team (who confirmed to have received the report)
March 16th, 2021 - No updates, disclosing
April 18th, 2021 - v6.4 released, fixing the issue
Proof of Concept
Affects Plugins
Fixed in 6.4 References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)
Submitter
Nguyen Anh Tien
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-03-16 (about 4 years ago)
Added
2021-03-16 (about 4 years ago)
Last Updated
2021-04-27 (about 4 years ago)
WPScan 