CVE-2022-1093CWE-79

WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs

published May 23, 2022

CVSS
—
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00615 · 48.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-05-23T07:15Z
EPSS history
Timeline
  • 23 MAY 07:15Z
    WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs
    cvelistv5