Seowriting
Monthly
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.