Search Atlas Seo
Monthly
Reflected cross-site scripting in the Search Atlas SEO WordPress plugin (versions 2.6.6 and earlier, distributed under the 'metasync' slug) lets an unauthenticated attacker inject script that executes in a victim's browser session when they follow a crafted link. Rated CVSS 7.1 with an elevated score due to a scope change, the flaw affects any WordPress site running the vulnerable plugin and can lead to session hijacking, admin action forgery, or redirection. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
Search Atlas SEO WordPress plugin (all versions before 2.6.12) exposes its Google Indexing API integration to any authenticated user - including low-privilege subscribers - due to a missing capability and nonce check in an AJAX handler. Any user with a valid WordPress session can invoke the plugin's Google Indexing API endpoint to submit or remove site URLs from Google's search index and exhaust the site's indexing API quota. A publicly available exploit exists via WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate limited observed exploitation activity at this time.
Reflected cross-site scripting in the Search Atlas SEO WordPress plugin (versions 2.6.6 and earlier, distributed under the 'metasync' slug) lets an unauthenticated attacker inject script that executes in a victim's browser session when they follow a crafted link. Rated CVSS 7.1 with an elevated score due to a scope change, the flaw affects any WordPress site running the vulnerable plugin and can lead to session hijacking, admin action forgery, or redirection. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
Search Atlas SEO WordPress plugin (all versions before 2.6.12) exposes its Google Indexing API integration to any authenticated user - including low-privilege subscribers - due to a missing capability and nonce check in an AJAX handler. Any user with a valid WordPress session can invoke the plugin's Google Indexing API endpoint to submit or remove site URLs from Google's search index and exhaust the site's indexing API quota. A publicly available exploit exists via WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate limited observed exploitation activity at this time.