Description
The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://wordpress.org/plugins/all-in-one-seo-pack/#developers ↗
- https://semperplugins.com/all-in-one-seo-pack-changelog/ ↗
- https://github.com/semperfiwebdesign/all-in-one-seo-pack/issues/2888 ↗
- https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-04_WordPress_Plugin_All_in_One_SEO_Pack ↗
- http://www.openwall.com/lists/oss-security/2019/10/16/5 ↗
- https://wpvulndb.com/vulnerabilities/9915 ↗