Stored Cross-Site Scripting in DELUCKS SEO Plugin for WordPress

CVE-2019-25146

What is CVE-2019-25146?

The DELUCKS SEO plugin for WordPress is susceptible to Stored Cross-Site Scripting through the saveSettings() function, which lacks proper capability checks. This vulnerability arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject arbitrary web scripts. The malicious scripts can execute whenever a victim accesses affected pages, posing significant security risks for website integrity and user safety. The issue affects all versions of the plugin up to and including 2.1.7.

References