Seo Redirection Plugin
Monthly
Missing capability check in the SEO Redirection Plugin for WordPress (versions before 9.19) exposes authenticated AJAX endpoints to any logged-in user, regardless of role. A subscriber-level account - the lowest WordPress user tier - can invoke the unprotected action to enumerate all configured 301 redirect rules, revealing source and destination URLs that may disclose internal site architecture, campaign tracking patterns, or sensitive path structures. No public exploitation in the wild has been confirmed by CISA KEV, but a proof-of-concept is publicly available per WPScan, raising the probability of opportunistic abuse against unpatched sites.
The SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing capability check in the SEO Redirection Plugin for WordPress (versions before 9.19) exposes authenticated AJAX endpoints to any logged-in user, regardless of role. A subscriber-level account - the lowest WordPress user tier - can invoke the unprotected action to enumerate all configured 301 redirect rules, revealing source and destination URLs that may disclose internal site architecture, campaign tracking patterns, or sensitive path structures. No public exploitation in the wild has been confirmed by CISA KEV, but a proof-of-concept is publicly available per WPScan, raising the probability of opportunistic abuse against unpatched sites.
The SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.