Stored Cross-Site Scripting (XSS) Vulnerability in Marketing and SEO Booster Plugin

CVE-2024-9066

What is CVE-2024-9066?

The Marketing and SEO Booster plugin for WordPress contains a vulnerability that allows authenticated users with Author-level access and above to perform Stored Cross-Site Scripting (XSS) attacks. This occurs due to a lack of adequate input sanitization and output escaping when handling SVG file uploads. When an attacker uploads a malicious SVG file, they can inject arbitrary JavaScript code that executes whenever users access the compromised SVG files. This vulnerability poses significant risks to the integrity of web applications, potentially leading to data theft, session hijacking, and other malicious activities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References