Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

347 results · page 5 of 7

Jan 7, 2025SEO Keywords: Reflected Cross-Site ScriptingCVE-2024-12126 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Keywords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘google_error’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SEO Keywords
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update SEO Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 20, 2024Wtyczka SeoPilot dla WP: Cross-Site Request ForgeryCVE-2024-11812 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wtyczka SeoPilot dla WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.091. This is due to missing or incorrect nonce validation on the SeoPilot_Admin_Options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Wtyczka SeoPilot dla WP
Affected
up to 3.3.091
What to do
Affects up to 3.3.091. Update Wtyczka SeoPilot dla WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024DELUCKS SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54259 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
Product
DELUCKS SEO
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024AI Content Writer, RSS Feed to Post, Autoblogging SEO Help: Reflected Cross-Site ScriptingCVE-2024-12156 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AI Content Writer, RSS Feed to Post, Autoblogging SEO Help
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update AI Content Writer, RSS Feed to Post, Autoblogging SEO Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2024LinkLaunder SEO: Cross-Site Request Forgery (CSRF)CVE-2024-53727 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Lars Koudal LinkLaunder SEO linklaunder-seo-plugin allows Stored XSS.This issue affects LinkLaunder SEO: from n/a through <= 0.92.1.
Product
LinkLaunder SEO
Affected
up to 0.92.1
What to do
Affects up to 0.92.1. Update LinkLaunder SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Rank Math SEO: Improper Control of Generation of Code ('Code Injection')CVE-2024-11620 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Control of Generation of Code ('Code Injection') vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Code Injection.This issue affects Rank Math SEO: from n/a through <= 1.0.231.
Product
Rank Math SEO
Affected
up to 1.0.231
What to do
Affects up to 1.0.231. Update Rank Math SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024SEO Landing Page Generator: Reflected Cross-Site ScriptingCVE-2024-11366 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Landing Page Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.66.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SEO Landing Page Generator
Affected
up to 1.66.2
What to do
Affects up to 1.66.2. Update SEO Landing Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2024Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic): Time-based SQL InjectionCVE-2024-11009 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic)
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 21, 2024Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO: Does not sanitise uploaded SVG filesCVE-2024-10482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO
Fixed in
1.5.0
What to do
Update Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO to 1.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 20, 2024Dynamic URL SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52470 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Reflected XSS.This issue affects Dynamic URL SEO: from n/a through <= 1.0.
Product
Dynamic URL SEO
Affected
up to 1.0
What to do
Affects up to 1.0. Update Dynamic URL SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 20, 2024In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on bCVE-2024-10515 · WordPress plugins & themes · reported by WPScanLow 3.5
In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
Product
process of testing the SEO Plugin by Squirrly SEO
Fixed in
12.3.21
What to do
Update process of testing the SEO Plugin by Squirrly SEO to 12.3.21 or newer.
Full record and what to do →NVD record wpscan.com
Nov 19, 2024Seo Free: Cross-Site Request Forgery (CSRF)CVE-2024-51642 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ivan9146 Seo Free seo-free allows Stored XSS.This issue affects Seo Free: from n/a through <= 1.4.
Product
Seo Free
Affected
up to 1.4
What to do
Affects up to 1.4. Update Seo Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024W3P SEO: Cross-Site Request Forgery (CSRF)CVE-2024-51684 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO wp-perfect-plugin allows Stored XSS.This issue affects W3P SEO: from n/a through < 1.8.6.
Product
W3P SEO
What to do
Update W3P SEO to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Simplistic SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51719 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roman Peterhans Simplistic SEO simplistic-seo allows Reflected XSS.This issue affects Simplistic SEO: from n/a through <= 2.3.0.
Product
Simplistic SEO
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Simplistic SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50454 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
Product
SEOPress
Affected
up to 8.1.1
What to do
Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50456 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
Product
SEOPress
Affected
up to 8.1.1
What to do
Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024SEOPress: Missing AuthorizationCVE-2024-50455 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
Product
SEOPress
Affected
up to 8.1.1
What to do
Affects up to 8.1.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Premium SEO Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50465 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP SEO – Calin Vingan Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 1.6.001.
Product
Premium SEO Pack
Affected
up to 1.6.001
What to do
Affects up to 1.6.001. Update Premium SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024WordPress Image SEO: Cross-Site Request Forgery (CSRF)CVE-2024-49627 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPress Image SEO: from n/a through 1.1.4.
Product
WordPress Image SEO
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update WordPress Image SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2024SEO Manager: Stored Cross-Site ScriptingCVE-2024-9521 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SEO Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SEO Manager
Affected
up to 1.9
What to do
Affects up to 1.9. Update SEO Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2024Marketing and SEO Booster: Stored Cross-Site ScriptingCVE-2024-9066 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Marketing and SEO Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Marketing and SEO Booster
Affected
up to 1.9.10
What to do
Affects up to 1.9.10. Update Marketing and SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 5, 2024Search Atlas SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47387 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 1.8.2.
Product
Search Atlas SEO
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Search Atlas SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: PHP Object InjectionCVE-2024-9314 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'set_redirections' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.228
What to do
Affects up to 1.0.228. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized modification and loss of dataCVE-2024-9161 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.228
What to do
Affects up to 1.0.228. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2024SEOPress – On-site SEO: Reflected Cross-Site ScriptingCVE-2024-9225 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEOPress – On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 8.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SEOPress – On-site SEO
Affected
up to 8.1.1
What to do
Affects up to 8.1.1. Update SEOPress – On-site SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45456 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.
Product
WP Meta SEO
Affected
up to 4.5.13
What to do
Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45455 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.
Product
WP Meta SEO
Affected
up to 4.5.13
What to do
Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Premium SEO Pack – WP SEO: Sensitive Information ExposureCVE-2024-3679 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.002. This makes it possible for unauthenticated attackers to view limited information from password protected posts through the social meta data.
Product
Premium SEO Pack – WP SEO
Affected
up to 1.6.002
What to do
Affects up to 1.6.002. Update Premium SEO Pack – WP SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 18, 2024SEO Plugin by Squirrly SEO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43286 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.3.19.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.3.19
What to do
Affects up to 12.3.19. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 24, 2024Optimize Images ALT Text (alt tag) & names for SEO using AI: Full Path DisclosureCVE-2024-6571 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Optimize Images ALT Text (alt tag) & names for SEO using AI
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Optimize Images ALT Text (alt tag) & names for SEO using AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 20, 2024SEO Plugin by Squirrly SEO: Stored Cross-Site ScriptingCVE-2024-6497 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 12.3.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-43286 appears to be a duplicate of this issue.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.3.19
What to do
Affects up to 12.3.19. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024Internal Link Juicer: SEO Auto Linker for: Cross-Site Request Forgery (CSRF)CVE-2024-37941 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Internal Link Juicer Internal Link Juicer: SEO Auto Linker for WordPress.This issue affects Internal Link Juicer: SEO Auto Linker for WordPress: from n/a through 2.24.3.
Product
Internal Link Juicer: SEO Auto Linker for
Affected
up to 2.24.3
What to do
Affects up to 2.24.3. Update Internal Link Juicer: SEO Auto Linker for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer: Full Path DisclosureCVE-2024-6556 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.10.8. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024SEOPress: Does not properly protect some of its REST API routesCVE-2024-5488 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
Product
SEOPress
Fixed in
7.9
What to do
Update SEOPress to 7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 2, 2024Rank Math SEO: Does not sanitise and escape some of its settingsCVE-2024-4627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings (by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin before 1.0.219) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Rank Math SEO
Fixed in
1.0.219
What to do
Update Rank Math SEO to 1.0.219 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 28, 2024SEO SIMPLE PACK: Information ExposureCVE-2024-2795 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SEO SIMPLE PACK plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.1 via META description. This makes it possible for unauthenticated attackers to extract limited information about password protected posts.
Product
SEO SIMPLE PACK
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update SEO SIMPLE PACK to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 24, 2024SEOPress: Does not validate and escape one of its Post settingsCVE-2024-4900 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post
Product
SEOPress
Fixed in
7.8
What to do
Update SEOPress to 7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 24, 2024SEOPress: Does not sanitise and escape some of its Post settingsCVE-2024-4899 · WordPress plugins & themes · reported by WPScanMedium 5
The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
Product
SEOPress
Fixed in
7.8
What to do
Update SEOPress to 7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2024SEOPress – On-site SEO: Stored Cross-Site ScriptingCVE-2024-1168 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping on user supplied image URLs. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SEOPress – On-site SEO
Affected
up to 7.9
What to do
Affects up to 7.9. Update SEOPress – On-site SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 11, 2024Yoast SEO Premium: Missing AuthorizationCVE-2023-28775 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.
Product
Yoast SEO Premium
Affected
up to 20.4
What to do
Affects up to 20.4. Update Yoast SEO Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024DELUCKS SEO: Missing AuthorizationCVE-2024-30538 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DELUCKS GmbH DELUCKS SEO.This issue affects DELUCKS SEO: from n/a through 2.5.4.
Product
DELUCKS SEO
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Praison SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34801 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mervin Praison Praison SEO WordPress seo-wordpress allows DOM-Based XSS.This issue affects Praison SEO WordPress: from n/a through <= 4.0.15.
Product
Praison SEO
Affected
up to 4.0.15
What to do
Affects up to 4.0.15. Update Praison SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 24, 2024SEOPress – On-site SEO: Stored Cross-Site ScriptingCVE-2024-1134 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as well as others in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SEOPress – On-site SEO
Affected
up to 7.5.2.1
What to do
Affects up to 7.5.2.1. Update SEOPress – On-site SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 20, 2024All in One SEO: Does not validate and escape some of its Post fields before outputting them backCVE-2024-3368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
All in One SEO
Fixed in
4.6.1.1
What to do
Update All in One SEO to 4.6.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2024Rank Math SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23888 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rank Math Rank Math SEO allows Path Traversal.This issue affects Rank Math SEO: from n/a through 1.0.107.2.
Product
Rank Math SEO
Affected
up to 1.0.107.2
What to do
Affects up to 1.0.107.2. Update Rank Math SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2024Rank Math SEO with AI Best SEO Tools: Stored Cross-Site ScriptingCVE-2024-4617 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in versions up to, and including, 1.0.218 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rank Math SEO with AI Best SEO Tools
Affected
up to 1.0.218
What to do
Affects up to 1.0.218. Update Rank Math SEO with AI Best SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2024Yoast SEO: Stored Cross-Site ScriptingCVE-2024-4984 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Yoast SEO
Affected
up to 22.6
What to do
Affects up to 22.6. Update Yoast SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.yoast.com github.com
May 14, 2024Alt Text AI – Automatically generate image alt text for SEO and accessibility: Generic SQL InjectionCVE-2024-4847 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘last_post_id’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Alt Text AI – Automatically generate image alt text for SEO and accessibility
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Alt Text AI – Automatically generate image alt text for SEO and accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024Rank Math SEO with AI Best SEO Tools: Stored Cross-Site ScriptingCVE-2024-4335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textAlign’ parameter in versions up to, and including, 1.0.217 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rank Math SEO with AI Best SEO Tools
Affected
up to 1.0.217
What to do
Affects up to 1.0.217. Update Rank Math SEO with AI Best SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024Joli FAQ SEO – WordPress FAQ: Cross-Site Request ForgeryCVE-2024-4082 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Joli FAQ SEO – WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Joli FAQ SEO – WordPress FAQ
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Joli FAQ SEO – WordPress FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.