CVE Database /
CVE-2024-3368
CVE · Medium
CVE-2024-3368 — All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.6.1.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-3368
|
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.6.1.1 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 4.6.1.1
|
4.6.1.1 |
2024-04-29 |
—
|
CVE-2024-3368
The All in One SEO plugin for WordPress contains a stored cross-site scripting vulnerability in the meta description field affecting versions through 4.6.0, caused by inadequate sanitization of user input and escaping of output. Attackers with Contributor-level permissions or higher can exploit this flaw to inject malicious scripts that execute when visitors view pages containing the injected code. The vulnerability has been fixed in version 4.6.1.1.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings