Seo Plugin By Squirrly Seo CVE-2022-38140

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2022-11-28 audit@patchstack.com

WordPress File Upload Seo Plugin By Squirrly Seo Squirrly

8.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Nov 28, 2022 - 20:15 nvd

HIGH 8.8

DescriptionNVD

Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.

AnalysisAI

Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress. Affected products include: Squirrly Seo Plugin By Squirrly Seo.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Seo Plugin By Squirrly Seo

View all

CVE-2024-6497 HIGH Act Now POC

Stored Cross-Site Scripting in the SEO Plugin by Squirrly SEO for WordPress (versions up to and including 12.3.19) allow

CVE-2024-43286 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly SEO Plugi

CVE-2025-22783 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SEO Squirrly SEO P

CVE-2023-50854 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly

CVE-2024-10515 LOW Monitor POC

In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that

CVE-2024-29790 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Squirrly SEO Plugi

CVE-2026-66664 HIGH This Week

Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated

CVE-2025-24654 HIGH This Week

Missing Authorization vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO.4.05. Rated high severity (CVSS 7.1), thi

CVE-2026-66614 HIGH This Week

Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers wit

CVE-2025-1768 MEDIUM This Month

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in a

CVE-2022-44626 MEDIUM This Month

Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.1.20. Rated medium severity (CVSS 6.3), this

CVE-2026-52714 MEDIUM This Month

Broken access control in SEO Plugin by Squirrly SEO version 12.4.16 and earlier allows unauthenticated remote attackers

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2024-50623 CRITICAL POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2018-9206 CRITICAL POC

CVE-2024-5084 CRITICAL POC

Same technique File Upload

View all

CVE-2016-3088 CRITICAL POC

CVE-2017-12617 HIGH POC

CVE-2020-1938 CRITICAL POC

CVE-2024-50623 CRITICAL POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2018-9206 CRITICAL POC

CVE-2024-5084 CRITICAL POC

Share

CVE-2022-38140 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy