¿Podemos ayudarte? LLama o escríbenos al 611 614 112 [L-V de 9 a 18h.]
Envío gratis a la península a partir de 60€
¿Podemos ayudarte? 611 614 112 [L-V de 9 a 18h.]
Envío gratis a la península a partir de 60€
€24,95
€23,95
€23,95
€23,95
€23,95
€23,95
€23,95
€23,95
€23,95
€23,95
€23,95
€23,95
«Yoast SEO – Advanced SEO with real-time guidance and built-in AI»,»plugin»:»wordpress-seo»,»link»:»https:\/\/wordpress.org\/plugins\/wordpress-seo\/»,»latest»:»1752568680″,»closed»:0,»vulnerability»:[{«uuid»:»c9f67e5eadc4369a09a16d49272dd369a81de336066febd4322bd661c919ab73″,»name»:»Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 17.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"17.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-25118","name":"CVE-2021-25118","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-25118","description":"[en] The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp\/v2\/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.","date":"2022-02-28"},{"id":"7e72d5c911ad52d49704f43e5c9b36c8cc717b9e","name":"WordPress Yoast SEO <= 17.2.1 - Unauthenticated Full Path Disclosure vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-17-2-1-unauthenticated-full-path-disclosure-vulnerability","description":"Unauthenticated Full Path Disclosure vulnerability discovered by Fariq Fadillah Gusti Insani in WordPress Yoast SEO (versions <= 17.2.1).","date":"2022-02-23"},{"id":"5754801ba32dd72a1b2cf7360ed0d6a8a3f2d59c","name":"Yoast SEO <= 17.2 - Full Path Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-172-full-path-disclosure","description":"The Yoast SEO plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 17.2 via the \/wp\/v2\/posts REST endpoints that discloses the full internal path of featured images from posts. This makes it possible for unauthenticated attackers to extract sensitive data which consists of full site path information which can be used to exploit other vulnerabilities.","date":"2021-10-05"},{"id":"2c3f9038-632d-40ef-a099-6ea202efb550","name":"Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure","link":"https:\/\/wpscan.com\/vulnerability\/2c3f9038-632d-40ef-a099-6ea202efb550","description":"The plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp\/v2\/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.","date":null}],"impact":{"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}]}},{"uuid":"e79c4c8ed273f442128b86f5bb5b34c9c838e76fd822fb7e9faa20d3de26a627","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.4.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.4.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24153","name":"CVE-2021-24153","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24153","description":"[en] A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.","date":"2021-04-05"},{"id":"b61eabadb06a4c3b543a092ab6ea8ef2c11e6831","name":"Yoast SEO <= 3.4.0 - Authenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-340-authenticated-stored-cross-site-scripting","description":"A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting parentheses as well as several functions such as alert, but bypasses were found.","date":"2016-08-02"},{"id":"77810044-394d-4314-b9a1-20c7dca726dc","name":"Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/77810044-394d-4314-b9a1-20c7dca726dc","description":"A stored XSS scripting vulnerability was discovered in the plugin, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.","date":null}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"d593084b5162acc436628500720f46d739718cb7d24b369dc9cf26b66ae42fb8","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 11.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"11.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2019-13478","name":"CVE-2019-13478","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2019-13478","description":"[en] The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.","date":"2019-07-09"},{"id":"91236a5d194b558bc89183cbe9fc966b3956a63b","name":"WordPress Yoast SEO plugin 1.2.0-11.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-plugin-1-2-0-11-5-authenticated-stored-cross-site-scripting-xss-vulnerability","description":"Authenticated Stored Cross-Site Scripting (XSS) vulnerability found by Sybre Waaijer in WordPress Yoast SEO plugin (versions 1.2.0-11.5).","date":"2019-07-10"},{"id":"d291f62007ebfaaa030e01a68cfd2f5e7c03f140","name":"Yoast SEO <= 11.5 - Authenticated Stored Cross Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-115-authenticated-stored-cross-site-scripting","description":"The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via term descriptions in versions up to, and including, 11.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with post editor access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2019-07-09"},{"id":"8bc4cf95-79f7-4d92-b320-a841ab7e6a6f","name":"Yoast SEO 1.2.0-11.5 - Authenticated Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/8bc4cf95-79f7-4d92-b320-a841ab7e6a6f","description":"The vendor's description, reference included below:\r\n\r\n"Yoast SEO 11.6 also fixes a security issue regarding term pages in WordPress. Unfiltered code was allowed in some fields. This, however, does not pose a problem for single user sites. In specific cases, on multisite installs, this might become an issue because of the way user roles function."","date":null}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"44510927a2f8b0cc05919a39195a29c163412f96564944c328b0be15fc7eb148","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 9.2.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"9.2.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2018-19370","name":"CVE-2018-19370","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2018-19370","description":"[en] A Race condition vulnerability in unzip_file in admin\/import\/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.","date":"2018-11-28"},{"id":"19b1f491777ffee42e472492777500d78c861e04","name":"Yoast SEO <= 9.1.0 - Race Condition to Remote Code Execution","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-910-race-condition-to-remote-code-execution","description":"A Race condition vulnerability in unzip_file in admin\/import\/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.","date":"2018-11-06"},{"id":"bd32be83-db19-4026-adc9-9da284849ee3","name":"Yoast SEO <= 9.1 - Authenticated Race Condition","link":"https:\/\/wpscan.com\/vulnerability\/bd32be83-db19-4026-adc9-9da284849ee3","description":"According to the changelog,\r\n\r\n"Race Condition which leads to command execution, by users with SEO Manager roles."","date":null}],"impact":{"cwe":[{"cwe":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","description":"The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently."}]}},{"uuid":"3cd1de9d904fee59207111dc6694df6ae1f652f093b34c751ff8b298fb4981cc","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 5.8.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.8.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2017-16842","name":"CVE-2017-16842","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2017-16842","description":"[en] Cross-site scripting (XSS) vulnerability in admin\/google_search_console\/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.","date":"2017-11-16"},{"id":"679f5f32b59eead7eba69d0a53c61cd11b099505","name":"Yoast SEO <= 5.7.1 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-571-reflected-cross-site-scripting","description":"Cross-site scripting (XSS) vulnerability in admin\/google_search_console\/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.","date":"2017-11-22"},{"id":"41e0aa47-f2f6-4f64-a95e-ed5c884bfe9e","name":"Yoast SEO <= 5.7.1 - Authenticated Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/41e0aa47-f2f6-4f64-a95e-ed5c884bfe9e","description":"Cross-site scripting (XSS) vulnerability in admin\/google_search_console\/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.","date":null}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"953a26067b779ace898d55af4f1cc9f10216f53390fc3637a98e54585e9eb41d","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2012-6692","name":"CVE-2012-6692","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2012-6692","description":"[en] Cross-site scripting (XSS) vulnerability in js\/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin\/post-new.php, which is not properly handled in the snippet preview functionality.","date":"2015-06-17"},{"id":"16320dc11948d1d08a4331dcb6bbb8c52a32e4e2","name":"Yoast SEO <= 2.1.1 - Cross Site Scripting via post_title parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-211-cross-site-scripting-via-post-title-parameter","description":"Cross-site scripting (XSS) vulnerability in js\/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin\/post-new.php, which is not properly handled in the snippet preview functionality.","date":"2012-10-31"},{"id":"3cb6636b-ffc5-4dd7-bca6-62c1ab06e6c8","name":"Yoast SEO <= 2.1.1 - Authenticated Stored DOM XSS","link":"https:\/\/wpscan.com\/vulnerability\/3cb6636b-ffc5-4dd7-bca6-62c1ab06e6c8","description":"The "snippet preview" functionality of the Yoast WordPress SEO plugin was susceptible to cross-site scripting in versions before 2.2.","date":null}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"8355d9685b7693cb139a656a045d88dcd39b1f5fdd91d774673dc06e5e36a157","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.7.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2015-2292","name":"CVE-2015-2292","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2015-2292","description":"[en] Multiple SQL injection vulnerabilities in admin\/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin\/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.","date":"2015-03-17"},{"id":"408a3eeb051769dac551ee7b09d5e8b573aef84c","name":"WordPress SEO by Yoast Plugin 1.7.3.3 - Blind SQL Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-seo-by-yoast-plugin-1-7-3-3-blind-sql-injection","description":"SEO by Yoast plugin is prone to a blind SQL injection vulnerability. This vulnerability is found \"admin\/class-bulk-editor-list-table.php\". Because of it, the orderby and order \"get\" parameters are not sufficiently sanitised before being used within a SQL query.\nUpdate the plugin.","date":"2015-03-16"},{"id":"786a60e84c02b8fb197eb1a62072f17a5d12ea8b","name":"Yoast SEO <= 1.7.3.3 - Blind SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-1733-blind-sql-injection","description":"Multiple SQL injection vulnerabilities in admin\/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin\/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.","date":"2015-03-11"}],"impact":{"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}]}},{"uuid":"4ee412a65a7394e1b6d200d4386c2abfcccabc254d7716ca3cc007326da09650","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.7.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2015-2293","name":"CVE-2015-2293","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2015-2293","description":"[en] Multiple cross-site request forgery (CSRF) vulnerabilities in admin\/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.","date":"2015-03-17"},{"id":"05468345333e3b9c8221b30847d34c2d4f5704ca","name":"WordPress SEO by Yoast Plugin <= 1.7.3 - Multiple Vulnerabilities","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-seo-by-yoast-plugin-1-7-3-multiple-csrf","description":"Multiple cross-site request forgery vulnerabilities exist in admin\/class-bulk-editor-list-table.php. Because of these vulnerabilities, the attackers can hijack the authentication of certain users for requests that conduct SQL injection attacks.\nUpdate the plugin.","date":"2015-03-14"},{"id":"f24a22f8d6f591fa8de9754a60304874a7d6895e","name":"Yoast SEO <= 1.7.3.3 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-1733-cross-site-request-forgery","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in admin\/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.","date":"2015-03-10"},{"id":"3ca70b21-8238-43fe-957a-71f845b3c105","name":"Yoast SEO <= 1.7.3.3 - Blind SQL Injection","link":"https:\/\/wpscan.com\/vulnerability\/3ca70b21-8238-43fe-957a-71f845b3c105","description":"Title: WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection\r\nVersion\/s Tested: 1.7.3.3\r\nCVSSv2 Base Score: 9 (AV:N\/AC:L\/Au:S\/C:C\/I:C\/A:C\/E:POC\/RL:OF\/RC:C)\r\nCVSSv2 Temporal Score: 7 (AV:N\/AC:L\/Au:S\/C:C\/I:C\/A:C\/E:POC\/RL:OF\/RC:C)\r\n\r\nDescription:\r\n\r\nWordPress SEO by Yoast is a popular WordPress plugin (wordpress-seo) used to improve the Search Engine Optimization (SEO) of WordPress sites. The latest version at the time of writing (1.7.3.3) has been found to be affected by two authenticated (admin, editor or author user) Blind SQL Injection vulnerabilities. The plugin has more than one million downloads according to WordPress.\r\n\r\nTechnical Description:\r\n\r\nThe authenticated Blind SQL Injection vulnerability can be found within the 'admin\/class-bulk-editor-list-table.php' file. The orderby and order GET parameters are not sufficiently sanitised before being used within a SQL query.\r\n\r\nLine 529:\r\n\r\n$orderby = ! empty( $_GET['orderby'] ) ? esc_sql( sanitize_text_field( $_GET['orderby'] ) ) : 'post_title';\r\n\r\nLine 533:\r\n\r\norder = esc_sql( strtoupper( sanitize_text_field( $_GET['order'] ) ) );\r\n\r\nIf the GET orderby parameter value is not empty it will pass its value through WordPess's own esc_sql() function. According to WordPress this function 'Prepares a string for use as an SQL query. A glorified addslashes() that works with arrays.'. However, this is not sufficient to prevent SQL Injection as can be seen from our Proof of Concept.\r\n\r\nProof of Concept (PoC):\r\n\r\nThe following GET request will cause the SQL query to execute and sleep for 10 seconds if clicked on as an authenticated admin, editor or author user.\r\n\r\nhttp:\/\/127.0.0.1\/wp-admin\/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date%2c(select%20*%20from%20(select(sleep(10)))a)&order=asc\r\n\r\nUsing SQLMap:\r\n\r\npython sqlmap.py -u "http:\/\/127.0.0.1\/wp-admin\/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date*&order=asc" --batch --technique=B --dbms=MySQL --cookie="wordpress_9d...; wordpress_logged_in_9dee67...;"\r\n\r\nImpact:\r\n\r\nAs there is no anti-CSRF protection a remote unauthenticated attacker could use this vulnerability to execute arbitrary SQL queries on the victim WordPress web site by enticing an authenticated admin, editor or author user to click on a specially crafted link or visit a page they control.\r\n\r\nOne possible attack scenario would be an attacker adding their own administrative user to the target WordPress site, allowing them to compromise the entire web site.\r\n\r\nTimeline:\r\n\r\nMarch 10th 2015 - 15:30 GMT: Vulnerability discovered by Ryan Dewhurst (WPScan Team - Dewhurst Security).\r\nMarch 10th 2015 - 18:30 GMT: Technical review by FireFart (WPScan Team).\r\nMarch 10th 2015 - 20:00 GMT: Vendor contacted via email.\r\nMarch 10th 2015 - 21:25 GMT: Vendor replies, confirms issue and gave expected patch timeline.\r\nMarch 11th 2015 - 12:05 GMT: Vendor released version 1.7.4 which patches this issue.\r\nMarch 11th 2015 - 12:30 GMT: Advisory released.","date":null}],"impact":{"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}]}},{"uuid":"deceef5f25eba8091250823abd1e7555a087c45141ddfdd52deeebebf0af4771","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 9.2.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"9.2.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"9f1951f972fbaf32618efcf64c4e90533706fb66","name":"WordPress Yoast SEO plugin <= 9.1.0 - Authenticated Command Execution vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-plugin-9-1-0-authenticated-command-execution-vulnerability","description":"Authenticated Command Execution vulnerability found by Dimopoulos Elias in WordPress Yoast SEO plugin (versions <= 9.1).","date":"2018-11-20"}],"impact":[]},{"uuid":"d2188ae68dcd0da48d6ce6251af0c25423327690154315464ae2081e289b6744","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 5.8.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.8.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"3f67ebcb08c1f71ac15142a504c0f011592246da","name":"WordPress Yoast SEO plugin <=5.7.1 - Unauthenticated Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-plugin-5-7-1-unauthenticated-cross-site-scripting-xss-vulnerability","description":"Unauthenticated Cross-Site Scripting (XSS) vulnerability found in WordPress Yoast SEO plugin (versions <=5.7.1). Vulnerability found in \"admin\/google_search_console\/class-gsc-table.php\" of the WordPress Yoast SEO plugin versions before version 5.8.0, and it allows remote attackers to inject arbitrary web script or HTML.","date":"2017-11-20"}],"impact":[]},{"uuid":"02c6e05dce9df438df73ea1d555e13b3e6374aa473e477c9f4a537a7a39ee335","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.3.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"f1dc794a06484846baf6074fae97e7b2918e5ef6","name":"WordPress Yoast SEO plugin <= 3.3.1 - Cross-site Request Forgery (CSRF) Vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-3-3-1-cross-site-request-forgery-csrf-vulnerability","description":"WordPress Yoast SEO plugin Cross-site Request Forgery (CSRF) exists on \/wp-admin\/admin.php?page=wpseo_tools&tool=import-export page.\nUpdate the plugin.","date":"2017-05-11"}],"impact":[]},{"uuid":"4edde3b81b8f49b769c7df8b8ffeb697633a65c95bb3747211e4f43835c3dddc","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.4.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.4.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"b135a3fa18af9eef8697f645f8e224c02066545e","name":"WordPress SEO by Yoast Plugin <= 3.4.0 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-seo-by-yoast-plugin-3-4-0-cross-site-scripting","description":"This plugin is prone to a stored cross site scripting vulnerability.\nUpdate the plugin.","date":"2016-08-03"}],"impact":[]},{"uuid":"517508d538ba540f8e303100e3255916a74805b0a65d74711bb288f26d592ae6","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.4.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"5c9437fb528aa5831e96542da230a98c8a751c17","name":"WordPress SEO by Yoast Plugin <= 1.4.4 - Unknown Vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-seo-by-yoast-plugin-1-4-4-unknown-vulnerability","description":"This plugin is prone to an security issue which allowed any user to reset settings.\nUpdate the plugin.","date":"2016-07-28"}],"impact":[]},{"uuid":"3301354740c77191b1a833858165de167781655f8c650c67c0376d9ac34e8fce","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.4.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"19da9f3d2a5238b2785cba771dbe9b3f2d59e828","name":"WordPress SEO by Yoast Plugin <= 1.4.6 - Bypass","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-seo-by-yoast-plugin-1-4-6-bypass","description":"This plugin is prone to a reset settings feature access restriction bypass vulnerability.\nUpdate the plugin.","date":"2016-07-28"}],"impact":[]},{"uuid":"fb264eab4f929abb92112ca3b002a7baea97a1d565c534bfdc808646e00c4c7a","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.3.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"1507617596829fd8feb2d93397472a18c86766b5","name":"WordPress SEO by Yoast Plugin <= 3.2.5 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-seo-by-yoast-plugin-3-2-5-cross-site-scripting","description":"This plugin is prone to an unspecified cross site scripting vulnerability.\nUpdate the plugin.","date":"2016-06-14"}],"impact":[]},{"uuid":"e1eafa9535b1f6f4dcd1d728d88d3f7c6608a06164166acff98e82452d1eb6e6","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.2.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"934c9a0e1211833cd493da537146da0e73eea67c","name":"WordPress SEO by Yoast Plugin <= 3.2.4 - Sensitive Data Exposure","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-seo-by-yoast-plugin-3-2-4-sensitive-data-exposure","description":"This plugin is prone to a subscriber settings sensitive data exposure vulnerability.\nUpdate the plugin.","date":"2016-05-06"}],"impact":[]},{"uuid":"2f093ee917a5d5230e47904e30efb1c80fac7885c43de6a8a240df6e93200792","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"37cbbbc3f1e0a53c3884af8eac11d574018f5855","name":"WordPress SEO by Yoast Plugin <= 2.0.1 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-seo-by-yoast-plugin-2-0-1-cross-site-scripting","description":"This plugin is prone to cross site scripting vulnerability because of misuse of the add_query_arg() and remove_query_arg() functions.\nUpdate the plugin.","date":"2015-04-20"}],"impact":[]},{"uuid":"7f2619adec9d3ffcd934ace069ff56bdb3536f297a44b7282196f22f2b85bd0e","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.3.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"222efa30b3aee1e97e60b8a0834719d50b60fdfe","name":"Yoast SEO <= 3.2.5 - Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-325-cross-site-scripting","description":"The Yoast SEO plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.2.5 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.","date":"2016-06-14"}],"impact":[]},{"uuid":"ad93c471e5c7f9f45a9e88e8dbe2ff2e655411a466b920343b0e0c2320e25d34","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.2.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"7a7017aeceffd3d8015e0a34efcc3b5cdb615f24","name":"Yoast SEO <= 3.2.4 - Sensitive Data Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-324-sensitive-data-exposure","description":"The Yoast SEO plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including 3.2.4. This is due to privileged AJAX actions being executable by regular users. This makes it possible for registered attackers to extract sensitive data including Yoast SEO settings and post metadata relative to focus and term keywords.","date":"2016-05-06"}],"impact":[]},{"uuid":"e79447e47a65bf12afd999bb7c50aac38450a6246930f3447d9315ba7ae2754c","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"1075874006169468047b40e8254e7cd791e57602","name":"Yoast SEO <= 2.0.1 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-201-reflected-cross-site-scripting","description":"The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on remove_query_arg and add_query_arg. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.","date":"2015-04-20"}],"impact":[]},{"uuid":"16e7168763e100aefc61e75d02cd73758af9803a20668e665a0e626011aff4ff","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.4.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"be47159c38aad92a256bf3c82cfeb752cdc076bf","name":"Yoast SEO <= 1.4.6 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-146-missing-authorization","description":"The Yoast SEO plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the reset settings function in versions up to, and including, 1.4.6. This makes it possible for unauthorized attackers to reset the plugin's settings.","date":"2014-08-01"}],"impact":[]},{"uuid":"ce051045a72fff6597ff0a9fc5ab2744db72691d26dcbe036c1f109a5b44f300","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 20.2.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"20.2.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"3e91ce36b42d19e27aae7b843e7bb9932c3ac45f","name":"Yoast SEO <= 20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-202-authenticated-contributor-dom-based-cross-site-scripting","description":"The Yoast SEO plugin for WordPress is vulnerable to DOM-based Cross-Site Scripting via individual post SEO details in versions up to, and including, 20.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level requirements and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2023-03-02"}],"impact":[]},{"uuid":"3b3b87c1baae0dec796d3a7688835ed044860bdf312002f103208376f4961d7e","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 20.2.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"20.2.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"b72613e2c74642b2006b7c631ac156cb96ba8ef0","name":"WordPress Yoast SEO Plugin <= 20.2 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-plugin-20-2-authenticated-contributor-dom-based-cross-site-scripting-vulnerability","description":"Update the WordPress Yoast SEO plugin to the latest available version (at least 20.2.1).\nWordFence discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Yoast SEO Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 20.2.1.","date":"2023-03-03"}],"impact":[]},{"uuid":"08c341d4c1a5d06cb21a25b501e04d8fc0c41e3c09d3a80ff1ac41621bd273fe","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.3.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"a8217395-3fba-4bf7-b5d6-38b17d71803b","name":"Yoast SEO <= 3.2.5 - Unspecified Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/a8217395-3fba-4bf7-b5d6-38b17d71803b","description":"Changelog file for version 3.3.0 states "Fixes an XSS issue, props Hristo Pandjarov."","date":null}],"impact":[]},{"uuid":"bade22a27d9c88e48507e948eba10259f6c9dff71cea1845964db57eab480006","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.2.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"30d2bb5a-2718-4755-9d4c-c88caf99e51a","name":"Yoast SEO <= 3.2.4 - Subscriber Settings Sensitive Data Exposure","link":"https:\/\/wpscan.com\/vulnerability\/30d2bb5a-2718-4755-9d4c-c88caf99e51a","description":"The Yoast SEO WordPress plugin was affected by a Subscriber Settings Sensitive Data Exposure security vulnerability.","date":null}],"impact":[]},{"uuid":"560e1bf85ce9a51be501e5481334aa017fc499762e64f5dc12f3df2da341b7d9","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.4.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"b74e5246-cb29-40e2-8520-cae4bb328e42","name":"Yoast SEO < 1.4.7 - Reset Settings Feature Access Restriction Bypass","link":"https:\/\/wpscan.com\/vulnerability\/b74e5246-cb29-40e2-8520-cae4bb328e42","description":"The Yoast SEO WordPress plugin was affected by a Reset Settings Feature Access Restriction Bypass security vulnerability.","date":null}],"impact":[]},{"uuid":"cfc72fc4793b3ca853cb664a25998d8abe5de7312963f570c371a473a34a0fa7","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.4.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"e21b59ea-095a-40ba-9241-01e26dcfe8c5","name":"Yoast SEO - Security issue which allowed any user to reset settings","link":"https:\/\/wpscan.com\/vulnerability\/e21b59ea-095a-40ba-9241-01e26dcfe8c5","description":"The Yoast SEO WordPress plugin was affected by a Security issue which allowed any user to reset settings security vulnerability.","date":null}],"impact":[]},{"uuid":"1af5c8f448be316fe7d152ea8e4fd2e0af853758355c4ebf41d38d00c9dea3d1","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 21.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"21.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-40680","name":"CVE-2023-40680","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-40680","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n\/a through 21.0.","date":"2023-11-30"},{"id":"7c3655702f4eca881677d8b15b7c861dcb373b23","name":"WordPress Yoast SEO Plugin <= 21.0 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-plugin-21-0-cross-site-scripting-xss-vulnerability","description":"Update the WordPress Yoast SEO plugin to the latest available version (at least 21.1).\nRafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Yoast SEO Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 21.1.","date":"2023-11-24"},{"id":"8936a184fd00c6bd2275c0f1acd266bdc11b487c","name":"Yoast SEO <= 21.0 - Authenticated (Seo Manager+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-210-authenticated-seo-manager-stored-cross-site-scripting","description":"The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with seo manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2023-11-24"},{"id":"42b355cc-d7b6-474d-8578-9c1a99b1e3c7","name":"Yoast SEO < 21.1 - Authenticated (Seo Manager+) Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/42b355cc-d7b6-474d-8578-9c1a99b1e3c7","description":"The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with seo manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"5.9","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"578183b20341b7c3f186f817e24e310e8a55fa0108018e84f00ff141b6db28a5","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 22.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"22.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-4041","name":"CVE-2024-4041","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4041","description":"[en] The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 22.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2024-05-09"},{"id":"9f7405405e4d3d9cd32b0270935f5f5f71433120","name":"WordPress Yoast SEO Plugin <= 22.5 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-plugin-22-5-reflected-cross-site-scripting-vulnerability","description":"
WordPress Yoast SEO Plugin <= 22.5 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: Yoast SEO<\/p>
Link: https:\/\/wordpress.org\/plugins\/wordpress-seo\/#developers<\/p>
Affected Version <= 22.5<\/p>
Fixed in version 22.6 <\/p>«,»date»:»2024-05-06″},{«id»:»bd3e5dfcb654c662430130851d4fdf21656e9b01″,»name»:»Yoast SEO <= 22.5 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-225-reflected-cross-site-scripting","description":"The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 22.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2024-05-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"ea36f226e51ae418a989a11cd2d1626a5f7602216e2e4b6d75e91a8d43c29eff","name":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 22.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"22.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-4984","name":"CVE-2024-4984","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4984","description":"[en] The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018display_name\u2019 author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-05-16"},{"id":"3f675c52dfcda8554ee51b25d15b5999e15a0b93","name":"Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo\/yoast-seo-206-authenticated-contributor-stored-cross-site-scripting","description":"The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018display_name\u2019 author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-05-14"},{"id":"f7df2571972e04f0b06bff341397afd84f0736bf","name":"WordPress Yoast SEO Plugin <= 22.6 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wordpress-seo\/vulnerability\/wordpress-yoast-seo-plugin-22-6-authenticated-contributor-stored-cross-site-scripting-vulnerability","description":"
WordPress Yoast SEO Plugin <= 22.6 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: Yoast SEO<\/p>
Link: https:\/\/wordpress.org\/plugins\/wordpress-seo\/#developers<\/p>
Affected Version <= 22.6<\/p>
Fixed in version 22.7 <\/p>«,»date»:»2024-05-16″}],»impact»:{«cvss»:{«version»:»3.1″,»vector»:»CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N»,»av»:»n»,»ac»:»l»,»pr»:»l»,»ui»:»n»,»s»:»c»,»c»:»l»,»i»:»l»,»a»:»n»,»score»:»6.4″,»severity»:»m»,»exploitable»:»0.0″,»impact»:»0.0″},»cwe»:[{«cwe»:»CWE-79″,»name»:»Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)»,»description»:»The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.»}]}}]},»updated»:»1750132245″}
