Fv Simpler Seo
Monthly
Stored cross-site scripting in the FolioVision FV Simpler SEO WordPress plugin (versions through 1.9.7) lets a user who already holds a low-privilege account on the site persist malicious script into a plugin-managed input field, which then executes in the browser of a higher-privileged user - typically a logged-in administrator - who views the affected plugin or content page. Patchstack scores it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the S:C scope change indicating the injected script can affect resources beyond the vulnerable component; exploitation is gated on two prerequisites, a valid account (PR:L) and interaction by an authenticated victim (UI:R), so it is not an anonymous drive-by attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the plugin is a niche WordPress SEO extension rather than a widely deployed platform component, which limits practical exposure.
Stored cross-site scripting in the FolioVision FV Simpler SEO WordPress plugin (versions through 1.9.7) lets a user who already holds a low-privilege account on the site persist malicious script into a plugin-managed input field, which then executes in the browser of a higher-privileged user - typically a logged-in administrator - who views the affected plugin or content page. Patchstack scores it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the S:C scope change indicating the injected script can affect resources beyond the vulnerable component; exploitation is gated on two prerequisites, a valid account (PR:L) and interaction by an authenticated victim (UI:R), so it is not an anonymous drive-by attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the plugin is a niche WordPress SEO extension rather than a widely deployed platform component, which limits practical exposure.