CVE-2024-4900 SEOPress < 7.8 - Contributor+ Open Redirect
Contributors can perform open redirect attacks against users viewing malicious posts in the SEOPress WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-4900?
CVE-2024-4900 is a medium-severity vulnerability in Unknown SEOPress , published on 24 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post
Weakness: CWE-601
Which versions are affected by CVE-2024-4900?
It affects 1 product.
Products include Seopress Seopress.
How do I fix CVE-2024-4900?
No fix has been published for CVE-2024-4900 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-4900 being exploited?
There is no known exploitation of CVE-2024-4900 in the wild and no public exploit code.
Other vulnerabilities in Unknown SEOPress
- CVE-2024-5488 SEOPress < 7.9 - Unauthenticated Object Injection
- CVE-2023-1669 SEOPress < 6.5.0.3 - Admin+ PHP Object Injection
- CVE-2024-1168 SEOPress – On-site SEO <= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL
- CVE-2024-1134 SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-2165 SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting
Sources
Also known as GHSA-vjx7-hf5r-chv4.