Stored XSS Vulnerability in Squirrly SEO Plugin Could Lead to Account Takeover
CVE-2024-10515

Currently unrated

Key Information:

Vendor
Wordpress
Status
Seo Plugin By Squirrly Seo
Vendor
CVE Published:
20 November 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability has been identified in the Squirrly SEO WordPress Plugin that permits the embedding of malicious scripts, resulting in stored cross-site scripting (XSS) attacks. This flaw can be exploited by attackers to gain unauthorized access to user accounts, effectively creating a backdoor into the affected environments. Prior to version 12.3.21, editors could unintentionally introduce harmful scripts, exposing systems to significant security risks.

Affected Version(s)

SEO Plugin by Squirrly SEO 0 < 12.3.21

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10515 - Proof of Concept

References

https://wpscan.com/vulnerability/367aad17-fbb5-48eb-8829-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
WPScan
.