CVE-2023-6290

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.8MEDIUM
EPSS
0.1%
top 76.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown SeopressSeopress Seopress
Timeline
PublishedJan 22
Latest updateJun 24

Description

The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/seopress< 7.3

🔴Vulnerability Details

2
CVEList
WP SEO Press < 7.3 - Admin+ Stored XSS↗2024-01-22
▶
GHSA
GHSA-c9r5-885j-jmm2: The SEOPress WordPress plugin before 7↗2024-01-22
▶

📋Vendor Advisories

1
Chrome
Stable Channel Update for Desktop: CVE-2024-6290↗2024-06-24
▶
CVE-2023-6290 (MEDIUM CVSS 4.8) | The SEOPress WordPress plugin befor | cvebase.io