packetstormsecurity.com
http://packetstormsecurity.com/files/173725/WordPress-Seo-By-10Web-Cross-Site-Scripting.html CVE-2023-2224
MEDIUMNuclei
Seo By 10Web < 1.2.7 - Admin+ Stored XSS
Record summary
CVE-2023-2224 has a selected CVSS score of 4.8 (medium); EIP currently links 1 Nuclei template.
Description
The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 8, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
SEO by 10WebDefault status: unaffected | CVE List | Before 1.2.7 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMSeo By 10Web < 1.2.7 - Cross-Site ScriptingCVSS 4.8
The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Impact
High-privilege authenticated attackers (admin) can inject stored XSS through plugin settings fields, potentially compromising other administrator accounts even when unfiltered_html capability is disabled in WordPress multisite environments.
Remediation
Update SEO by 10Web plugin to version 1.2.7 or later that properly sanitizes and escapes settings fields to prevent stored XSS attacks.
WeaknessesCWE-79
Authorsluisfelipe146
Template tagscve2023cvewpscanpacketstormwpwordpresswp-pluginxssseo10webauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:10web:seo:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/a76b6d22-1e00-428a-8a04-12162bd0d992 https://packetstormsecurity.com/files/173725/WordPress-Seo-By-10Web-Cross-Site-Scripting.html https://nvd.nist.gov/vuln/detail/CVE-2023-2224
Source: ProjectDiscovery
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-2224 wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/a76b6d22-1e00-428a-8a04-12162bd0d992