Lucene search

K
wpexploitCharles NeillWPEX-ID:3CB6636B-FFC5-4DD7-BCA6-62C1AB06E6C8
HistoryJun 12, 2015 - 12:00 a.m.

Yoast SEO <= 2.1.1 - Authenticated Stored DOM XSS

2015-06-1200:00:00
Charles Neill
14

0.003 Low

EPSS

Percentile

70.0%

The “snippet preview” functionality of the Yoast WordPress SEO plugin was susceptible to cross-site scripting in versions before 2.2.

Vulnerable URL:
/wp-admin/post-new.php?post_title=<img src=x onerror=alert(1)>

Vulnerable Code (wordpress-seo/js/wp-seo-metabox.js):
function yst_clean(str) {
    	if (str == '' || str == undefined)
		    return '';

	    try {
		        str = jQuery('<div/>').html(str).text();
		        str = str.replace(/<\/?[^>]+>/gi, '');
		        str = str.replace(/\[(.+?)\](.+?\[\/\\1\])?/g, '');
	    } catch (e) {
	}

	return str;
}

Link: https://github.com/Yoast/wordpress-seo/blob/2.1.1/js/wp-seo-metabox.js#L1-13

0.003 Low

EPSS

Percentile

70.0%

Related for WPEX-ID:3CB6636B-FFC5-4DD7-BCA6-62C1AB06E6C8