CyberRota Analysis
AI-GeneratedThe SEOWriting plugin for WordPress versions up to 1.12.5 is vulnerable to a stored cross-site scripting (XSS) flaw, allowing authenticated contributors to inject malicious JavaScript via an overly permissive KSES allowlist. This vulnerability can be exploited to execute crafted scripts when higher-privileged users view or preview affected posts, posing risks of privilege escalation and account compromise. WordPress site administrators and users of the SEOWriting plugin should prioritize patching to mitigate potential attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.