PT-2024-34830 · Ciprian Popescu · W3P Seo

Soprobro · Published 2024-11-14 · Updated 2024-11-15 · CVE-2024-51684

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions W3P SEO versions prior to 1.8.6

Description A Cross-Site Request Forgery (CSRF) issue is present in Ciprian Popescu W3P SEO, leading to Stored Cross Site Scripting (XSS).

Recommendations For versions prior to 1.8.6, update to version 1.8.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive functionality to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-51684

Affected Products

W3P Seo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-51684 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wp-perfect-plugin/vulnerability/wordpress-w3p-seo-plugin-1-8-6-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/11008 · Telegram Post
• https://twitter.com/CVEnew/status/1857190657133277554 · Twitter Post
• https://patchstack.com/database/vulnerability/wp-perfect-plugin/wordpress-w3p-seo-plugin-1-8-6-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1857248581096231381 · Twitter Post