CVE-2024-10515

SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS

In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor

Affected

SEO Plugin by Squirrly SEO

CVSS v3.1 CNA

3.5 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

EPSS

0.31% chance of exploitation in the next 30 days, 23rd percentile

Published

2024-11-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/367aad17-fbb5-48eb-8829-5d3513098d02/

Security advisories

• https://wpscan.com/vulnerability/367aad17-fbb5-48eb-8829-5d3513098d02

References

• CVE Record
• NVD entry