Description
The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.
References (6)
Core 6
Core References
Product, Third Party Advisory x_refsource_misc
https://wordpress.org/plugins/all-in-one-seo-pack/#developers
Release Notes, Vendor Advisory x_refsource_misc
https://semperplugins.com/all-in-one-seo-pack-changelog/
Patch, Third Party Advisory x_refsource_misc
https://github.com/semperfiwebdesign/all-in-one-seo-pack/issues/2888
Exploit, Third Party Advisory x_refsource_misc
https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-04_WordPress_Plugin_All_in_One_SEO_Pack
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/10/16/5
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9915
Scores
CVSS v3
5.4
EPSS
0.0114
EPSS Percentile
78.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
semperplugins/all_in_one_seo_pack
< 3.2.7
Published
Oct 16, 2019
Tracked Since
Feb 18, 2026