Improper HTML Filtering in Yoast SEO Plugin for WordPress
CVE-2019-13478

9.9CRITICAL

Key Information:

Vendor
Wordpress
Status
Yoast Seo
Vendor
CVE Published:
9 July 2019

Summary

The Yoast SEO plugin for WordPress, prior to version 11.6-RC5, has a vulnerability that permits unfiltered HTML in term descriptions. This issue could lead to potential attacks where malicious code could be inserted, enabling attackers to exploit the site in various ways. Users of the affected versions are advised to upgrade to the latest release to mitigate risks associated with this vulnerability.

References

https://github.com/Yoast/wordpress-seo/releases/tag/11.6-RC5
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9445
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.