PT-2025-34966 · WordPress · Xagio Seo

Wesley · Published 2025-08-28 · Updated 2025-08-28 · CVE-2024-13807

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Xagio SEO plugin for WordPress versions through 7.1.0.5

Description: The Xagio SEO plugin for WordPress is susceptible to sensitive information exposure via the backup functionality. This is due to a weak filename structure and a lack of directory protection, potentially allowing unauthenticated attackers to extract sensitive data from backups, including the entire database and site files.

Recommendations: Update the Xagio SEO plugin to a version later than 7.1.0.5.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-13807

Affected Products

Xagio Seo

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13807 · Security Note
• https://plugins.trac.wordpress.org/changeset/3292024 · Note
• https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.19/modules/backups/models/xagio_backups.php#L1882 · Note
• https://t.me/CVEtracker/31101 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1960995852584940024 · Twitter Post
• https://twitter.com/CVEnew/status/1960942979499086016 · Twitter Post
• https://t.me/cveNotify/133802 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9d7b7f4b-6acb-4ccb-8f2e-951012996ac7?source=cve · Note