Stored Cross-Site Scripting Vulnerability in WP Meta SEO Plugin Affects WordPress Pages

CVE-2023-6961

What is CVE-2023-6961?

The WP Meta SEO plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities that arise from improper handling of the 'Referer' header. This flaw, present in all versions up to and including 4.5.12, allows unauthenticated attackers to inject malicious scripts into web pages. When users access these compromised pages, the injected scripts are executed, potentially leading to unauthorized actions and data exposure. The root causes include insufficient input sanitization and poor output escaping practices, emphasizing the need for developers to adhere to secure coding guidelines.

References