PT-2022-14013 · WordPress · Simple Seo

Jörgson · Published 2022-09-06 · Updated 2022-09-09 · CVE-2022-1628

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple SEO plugin for WordPress versions up to, and including 1.7.91

Description The issue is related to attribute-based stored Cross-Site Scripting due to insufficient sanitization or escaping on the SEO social and standard title parameters. This can be exploited by authenticated users with Contributor and above permissions to inject arbitrary web scripts into posts/pages that execute whenever an administrator accesses the page.

Recommendations For Simple SEO plugin for WordPress versions up to, and including 1.7.91, update to a version that includes proper sanitization or escaping of the SEO social and standard title parameters to prevent Cross-Site Scripting. As a temporary workaround, consider restricting access to the SEO social and standard title parameters for users with Contributor and above permissions until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1628

Affected Products

Simple Seo

References · 4

• https://osv.dev/vulnerability/CVE-2022-1628 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2754807%40cds-simple-seo&new=2754807%40cds-simple-seo&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1628 · Security Note
• https://wordfence.com/vulnerability-advisories/#CVE-2022-1628 · Note