Vulnerability · Published Nov 20, 2024 · Assigned by WPScan

CVE-2024-10515SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS

Low 3.5

In plain English

A low-severity security flaw in SEO Plugin by Squirrly SEO from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 73.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor

Affected products (as reported)

Vendor	Product	Versions
Unknown	SEO Plugin by Squirrly SEO	0 – before 12.3.21

References

https://wpscan.com/vulnerability/367aad17-fbb5-48eb-8829-5d3513098d02/ exploit, vdb-entry, technical-description