CVE-2024-13853

MEDIUMNuclei

SEO Tools <= 4.0.7 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13853 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 11, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SEO Tools

Default status: affected

CVE ListThrough 4.0.7affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress SEO Tools Plugin 4.0.7 - Cross-Site ScriptingCVSS 6.1

The SEO Tools WordPress plugin through version 4.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'src' parameter in the rssread.php file before outputting it back in the page, which could allow attackers to execute arbitrary JavaScript code in a victim's browser.

Impact

Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser via the src parameter, potentially stealing cookies or credentials.

Remediation

Update SEO Tools plugin to a version newer than 4.0.7.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2024wpwordpresswp-pluginxssseo-automatic-seo-toolsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Shodan: http.html:"seo-automatic-seo-tools"
FOFA: body="wp-content/plugins/seo-automatic-seo-tools/"
https://wpscan.com/vulnerability/52991dd9-41f7-4cf8-b8c9-56dd4e62bf0c https://nvd.nist.gov/vuln/detail/CVE-2024-13853

Source: ProjectDiscovery

References

2