Stored Cross-Site Scripting Vulnerability in Squirrly SEO Plugin for WordPress

CVE-2024-6497

Summary

The Squirrly SEO Plugin for WordPress is compromised by a Stored Cross-Site Scripting (XSS) vulnerability arising from inadequate input sanitization processes for the ‘url’ parameter. This flaw enables authenticated users with Contributor-level access and higher to execute arbitrary scripts on targeted pages. When these pages are accessed by other users, the injected scripts can run without their consent, potentially exposing sensitive data or performing unintended actions. The vulnerability affects all versions prior to and including version 12.3.19, thereby underlining the critical need for timely updates to mitigate exploitation risks.

References