CVE Database /
CVE-2019-16520
CVE · Medium
CVE-2019-16520 — All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 3.2.7
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2019-16520
|
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 3.2.7 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 3.2.7
|
3.2.7 |
2019-10-16 |
—
|
CVE-2019-16520
The All in One SEO Pack plugin before version 3.2.7 contains a stored cross-site scripting vulnerability that arises from inadequate sanitization of the SEO description field for posts. An attacker could inject malicious scripts through the plugin's placeholder replacement mechanism, which would then be stored and executed when the description is displayed. This flaw allows for persistent XSS attacks affecting any user who views the compromised content.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings