Arbitrary Web Script Injection Vulnerability in SEO Manager Plugin

CVE-2024-9521

Summary

The SEO Manager plugin for WordPress has a vulnerability that allows authenticated users with contributor-level permissions and above to exploit stored cross-site scripting. This vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes, enabling attackers to inject arbitrary scripts into web pages. When these compromised pages are accessed by other users, the injected scripts can execute, potentially leading to a variety of malicious activities, including data theft, session hijacking, or spreading malware.

References