Threats tagged 'ghsa-6rj2-cjrv-wr38'

The SEOPress AI SEO Plugin for WordPress versions up to and including 10.3 is vulnerable to stored cross-site scripting (XSS) via insufficient sanitization of specific Google Analytics tracking settings. Authenticated users with Subscriber-level access or higher can inject malicious scripts through the 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' settings, which are improperly sanitized before being embedded in inline JavaScript. This vulnerability allows arbitrary script execution in pages viewed by users.