CVE-2012-6692 Yoast SEO <= 2.1.1 - Cross Site Scripting via post_title parameter
MediumCVSS 4.3
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yoast wordpress seo | <= 2.1.1 | No fix listed |
| wordpress-seo(WordPress) | < 2.2 | 2.2 |
References
- packetstormsecurity.com exploit
- 20150613 Yoast Wordpress SEO Plugin <= 2.1.1 Stored, Authenticated XSS exploit mailing-list
- 75196 vdb-entry
- 1032580 vdb-entry
- inventropy.us exploit
- wordpress.org patch
- wordpress.org exploit
- yoast.com
- Wordfence Intelligence third-party-advisory
- www.cve.org