Seo Squirrly
Monthly
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.
Broken access control in SEO Plugin by Squirrly SEO version 12.4.16 and earlier allows unauthenticated remote attackers to perform unauthorized privileged actions, resulting in high integrity impact against affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting requests to restricted functionality without any credential validation. No public exploit code or active CISA KEV listing has been identified at time of analysis, though the CVSS high-complexity rating suggests exploitation requires meeting specific conditions beyond a simple direct request.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.
Broken access control in SEO Plugin by Squirrly SEO version 12.4.16 and earlier allows unauthenticated remote attackers to perform unauthorized privileged actions, resulting in high integrity impact against affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting requests to restricted functionality without any credential validation. No public exploit code or active CISA KEV listing has been identified at time of analysis, though the CVSS high-complexity rating suggests exploitation requires meeting specific conditions beyond a simple direct request.