CVE Database /
CVE-2024-4899
CVE · Medium
CVE-2024-4899 — SEOPress – AI SEO Plugin & On-site SEO [wp-seopress] < 7.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-4899
|
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress] < 7.8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.0
|
< 7.8
|
7.8 |
2024-06-03 |
—
|
CVE-2024-4899
The SEOPress plugin versions 7.7.2 and earlier contain a stored cross-site scripting vulnerability in the SEO Title field parameter caused by inadequate sanitization and escaping of user input. Attackers with Contributor role or higher permissions can inject malicious scripts that persist in the database and execute in the browsers of users visiting affected pages. This vulnerability requires authentication but allows arbitrary script execution within the WordPress environment.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings