Threats tagged 'ghsa-x6h5-q644-mq4f'

The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'title' parameter in all versions up to and including 0.9.9. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing HTML-entity-encoded payloads to bypass WordPress core's filtering mechanisms.