Search criteria

12 vulnerabilities found for wordpress_seo by yoast

FKIE_CVE-2017-16842

Vulnerability from fkie_nvd - Published: 2017-11-16 03:29 - Updated: 2025-04-20 01:37
Severity ?
4.8 (Medium) - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.
References
cve@mitre.orghttps://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
cve@mitre.orghttps://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.phpThird Party Advisory
cve@mitre.orghttps://wordpress.org/plugins/wordpress-seo/#developersRelease Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.phpThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/plugins/wordpress-seo/#developersRelease Notes, Third Party Advisory
Impacted products
Vendor Product Version
yoast wordpress_seo *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "8D25091F-F24F-4586-8A5D-FB517FA4AA94",
              "versionEndExcluding": "5.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) en admin/google_search_console/class-gsc-table.php en el plugin Yoast SEO en versiones anteriores a la 5.8.0 para WordPress permite que atacantes remotos inyecten scripts web o HTML arbitrarios."
    }
  ],
  "id": "CVE-2017-16842",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-11-16T03:29:00.300",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://wordpress.org/plugins/wordpress-seo/#developers"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://wordpress.org/plugins/wordpress-seo/#developers"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2012-6692

Vulnerability from fkie_nvd - Published: 2015-06-17 18:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
References
cve@mitre.orghttp://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.htmlExploit
cve@mitre.orghttp://seclists.org/fulldisclosure/2015/Jun/40Exploit
cve@mitre.orghttp://www.securityfocus.com/bid/75196
cve@mitre.orghttp://www.securitytracker.com/id/1032580
cve@mitre.orghttps://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/Exploit
cve@mitre.orghttps://wordpress.org/plugins/wordpress-seo/changelog/Patch
cve@mitre.orghttps://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerabilityExploit
cve@mitre.orghttps://yoast.com/wordpress-seo-2-2/
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2015/Jun/40Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/75196
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1032580
af854a3a-2127-422b-91ae-364da2661108https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/Exploit
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/plugins/wordpress-seo/changelog/Patch
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerabilityExploit
af854a3a-2127-422b-91ae-364da2661108https://yoast.com/wordpress-seo-2-2/
Impacted products
Vendor Product Version
yoast wordpress_seo *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "4A5A4DA3-0967-42BC-ADFF-94DEA410CBA7",
              "versionEndIncluding": "2.1.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en js/wp-seo-metabox.js en el plugin WordPress SEO by Yoast anterior a 2.2 para WordPress permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s del par\u00e1metro post_title en wp-admin/post-new.php, lo cual no se maneja correctamente en la funcionalidad de la previsualizaci\u00f3n de recortes (snippets)."
    }
  ],
  "id": "CVE-2012-6692",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2015-06-17T18:59:00.080",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2015/Jun/40"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/75196"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id/1032580"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://yoast.com/wordpress-seo-2-2/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2015/Jun/40"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/75196"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1032580"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://yoast.com/wordpress-seo-2-2/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2015-2293

Vulnerability from fkie_nvd - Published: 2015-03-17 15:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
References
cve@mitre.orghttp://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.htmlExploit
cve@mitre.orghttp://seclists.org/fulldisclosure/2015/Mar/73Exploit
cve@mitre.orghttp://www.securitytracker.com/id/1031920Exploit
cve@mitre.orghttps://wordpress.org/plugins/wordpress-seo/changelog/
cve@mitre.orghttps://wpvulndb.com/vulnerabilities/7841
cve@mitre.orghttps://yoast.com/wordpress-seo-security-release/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2015/Mar/73Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1031920Exploit
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/plugins/wordpress-seo/changelog/
af854a3a-2127-422b-91ae-364da2661108https://wpvulndb.com/vulnerabilities/7841
af854a3a-2127-422b-91ae-364da2661108https://yoast.com/wordpress-seo-security-release/Vendor Advisory
Impacted products
Vendor Product Version
yoast wordpress_seo *
yoast wordpress_seo 1.6.0
yoast wordpress_seo 1.6.1
yoast wordpress_seo 1.6.2
yoast wordpress_seo 1.6.3
yoast wordpress_seo 1.7.1
yoast wordpress_seo 1.7.2
yoast wordpress_seo 1.7.3
yoast wordpress_seo 1.7.3.1
yoast wordpress_seo 1.7.3.2
yoast wordpress_seo 1.7.3.3
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "AFD2D356-0447-4EE8-823D-0500E8496870",
              "versionEndIncluding": "1.5.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.0:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "2F19DB4E-EB9B-405E-8C7D-0A7273CEE779",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.1:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "58918158-0AEF-4DDB-8B95-56739C5F99CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "5FACBDE2-D9F4-4330-9D5E-0336F130D1C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.3:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "597D08B2-E58E-4AC4-B1F9-660015506A7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.1:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "84FDF198-8B7E-431A-802E-9EC6A23BAB96",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "8C4468DC-91D8-4AB8-9C13-A826E9AB50C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "B87AD79A-90D0-42FB-BA9B-F0E25F44A797",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.1:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "86C6AA39-810E-4688-991F-4B17672C6FCF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "F7762119-2B03-4B0D-B19A-42C6A74DBCAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.3:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "63AEC8FD-F526-4BB3-BE1D-37B45D7B7F2B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades cross-site request forgery (CSRF) en admin/class-bulk-editor-list-table.php en WordPress SEO en el plugin Yoast anterior a 1.5.7, 1.6.x anterior a 1.6.4, y 1.7.x anterior a 1.7.4 de WordPress permite a atacantes remotos secuestrar la autenticaci\u00f3n de ciertos usuarios en las peticiones que conllevan ataques de inyecci\u00f3n SQL a trav\u00e9s de (1) order_by o (2) par\u00e1metro order en la p\u00e1gina wpseo_bulk-editor"
    }
  ],
  "id": "CVE-2015-2293",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2015-03-17T15:59:01.847",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securitytracker.com/id/1031920"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://wpvulndb.com/vulnerabilities/7841"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://yoast.com/wordpress-seo-security-release/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securitytracker.com/id/1031920"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://wpvulndb.com/vulnerabilities/7841"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://yoast.com/wordpress-seo-security-release/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2015-2292

Vulnerability from fkie_nvd - Published: 2015-03-17 15:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
References
cve@mitre.orghttp://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.htmlExploit
cve@mitre.orghttp://seclists.org/fulldisclosure/2015/Mar/73Exploit
cve@mitre.orghttp://www.securitytracker.com/id/1031920Exploit
cve@mitre.orghttps://wordpress.org/plugins/wordpress-seo/changelog/
cve@mitre.orghttps://wpvulndb.com/vulnerabilities/7841Exploit
cve@mitre.orghttps://www.exploit-db.com/exploits/36413/
cve@mitre.orghttps://yoast.com/wordpress-seo-security-release/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2015/Mar/73Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1031920Exploit
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/plugins/wordpress-seo/changelog/
af854a3a-2127-422b-91ae-364da2661108https://wpvulndb.com/vulnerabilities/7841Exploit
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/36413/
af854a3a-2127-422b-91ae-364da2661108https://yoast.com/wordpress-seo-security-release/Vendor Advisory
Impacted products
Vendor Product Version
yoast wordpress_seo *
yoast wordpress_seo 1.6.0
yoast wordpress_seo 1.6.1
yoast wordpress_seo 1.6.2
yoast wordpress_seo 1.6.3
yoast wordpress_seo 1.7.1
yoast wordpress_seo 1.7.2
yoast wordpress_seo 1.7.3
yoast wordpress_seo 1.7.3.1
yoast wordpress_seo 1.7.3.2
yoast wordpress_seo 1.7.3.3
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "AFD2D356-0447-4EE8-823D-0500E8496870",
              "versionEndIncluding": "1.5.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.0:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "2F19DB4E-EB9B-405E-8C7D-0A7273CEE779",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.1:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "58918158-0AEF-4DDB-8B95-56739C5F99CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "5FACBDE2-D9F4-4330-9D5E-0336F130D1C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.3:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "597D08B2-E58E-4AC4-B1F9-660015506A7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.1:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "84FDF198-8B7E-431A-802E-9EC6A23BAB96",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "8C4468DC-91D8-4AB8-9C13-A826E9AB50C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "B87AD79A-90D0-42FB-BA9B-F0E25F44A797",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.1:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "86C6AA39-810E-4688-991F-4B17672C6FCF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.2:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "F7762119-2B03-4B0D-B19A-42C6A74DBCAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.3:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "63AEC8FD-F526-4BB3-BE1D-37B45D7B7F2B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades inyecci\u00f3n SQL en admin/class-bulk-editor-list-table.php en WordPress SEO por el plugin Yoast anterior a 1.5.7, 1.6.x anterior a 1.6.4, y 1.7.x anterior a 1.7.4 de WordPress permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a trav\u00e9s de (1) order_by o (2) par\u00e1metro order en la p\u00e1gina the wpseo_bulk-editor en wp-admin/admin.php. NOTA: esto se puede aprovechar mediante CSRF que permite a atacantes remotos ejecutar comandos SQL arbitrarios."
    }
  ],
  "id": "CVE-2015-2292",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-03-17T15:59:00.063",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securitytracker.com/id/1031920"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://wpvulndb.com/vulnerabilities/7841"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/36413/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://yoast.com/wordpress-seo-security-release/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securitytracker.com/id/1031920"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://wpvulndb.com/vulnerabilities/7841"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/36413/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://yoast.com/wordpress-seo-security-release/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2017-16842 (GCVE-0-2017-16842)

Vulnerability from cvelistv5 – Published: 2017-11-16 03:00 – Updated: 2024-08-05 20:35
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:35:21.321Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/wordpress-seo/#developers"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-11-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-28T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wordpress.org/plugins/wordpress-seo/#developers"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-16842",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html"
            },
            {
              "name": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php",
              "refsource": "MISC",
              "url": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php"
            },
            {
              "name": "https://wordpress.org/plugins/wordpress-seo/#developers",
              "refsource": "MISC",
              "url": "https://wordpress.org/plugins/wordpress-seo/#developers"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-16842",
    "datePublished": "2017-11-16T03:00:00",
    "dateReserved": "2017-11-15T00:00:00",
    "dateUpdated": "2024-08-05T20:35:21.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-6692 (GCVE-0-2012-6692)

Vulnerability from cvelistv5 – Published: 2015-06-17 18:00 – Updated: 2024-08-06 21:36
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:36:01.882Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://yoast.com/wordpress-seo-2-2/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability"
          },
          {
            "name": "1032580",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1032580"
          },
          {
            "name": "75196",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75196"
          },
          {
            "name": "20150613 Yoast Wordpress SEO Plugin \u003c= 2.1.1 Stored, Authenticated XSS",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/Jun/40"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-10-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://yoast.com/wordpress-seo-2-2/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability"
        },
        {
          "name": "1032580",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1032580"
        },
        {
          "name": "75196",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75196"
        },
        {
          "name": "20150613 Yoast Wordpress SEO Plugin \u003c= 2.1.1 Stored, Authenticated XSS",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/Jun/40"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-6692",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html"
            },
            {
              "name": "https://yoast.com/wordpress-seo-2-2/",
              "refsource": "CONFIRM",
              "url": "https://yoast.com/wordpress-seo-2-2/"
            },
            {
              "name": "https://wordpress.org/plugins/wordpress-seo/changelog/",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
            },
            {
              "name": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/",
              "refsource": "MISC",
              "url": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/"
            },
            {
              "name": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability",
              "refsource": "MISC",
              "url": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability"
            },
            {
              "name": "1032580",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1032580"
            },
            {
              "name": "75196",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75196"
            },
            {
              "name": "20150613 Yoast Wordpress SEO Plugin \u003c= 2.1.1 Stored, Authenticated XSS",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/Jun/40"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-6692",
    "datePublished": "2015-06-17T18:00:00",
    "dateReserved": "2015-06-17T00:00:00",
    "dateUpdated": "2024-08-06T21:36:01.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-2292 (GCVE-0-2015-2292)

Vulnerability from cvelistv5 – Published: 2015-03-17 15:00 – Updated: 2024-08-06 05:10
VLAI?
Summary
Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:10:15.868Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpvulndb.com/vulnerabilities/7841"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://yoast.com/wordpress-seo-security-release/"
          },
          {
            "name": "36413",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/36413/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
          },
          {
            "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
          },
          {
            "name": "1031920",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031920"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-30T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpvulndb.com/vulnerabilities/7841"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://yoast.com/wordpress-seo-security-release/"
        },
        {
          "name": "36413",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/36413/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
        },
        {
          "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
        },
        {
          "name": "1031920",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031920"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-2292",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpvulndb.com/vulnerabilities/7841",
              "refsource": "MISC",
              "url": "https://wpvulndb.com/vulnerabilities/7841"
            },
            {
              "name": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
            },
            {
              "name": "https://yoast.com/wordpress-seo-security-release/",
              "refsource": "CONFIRM",
              "url": "https://yoast.com/wordpress-seo-security-release/"
            },
            {
              "name": "36413",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/36413/"
            },
            {
              "name": "https://wordpress.org/plugins/wordpress-seo/changelog/",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
            },
            {
              "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
            },
            {
              "name": "1031920",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031920"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-2292",
    "datePublished": "2015-03-17T15:00:00",
    "dateReserved": "2015-03-13T00:00:00",
    "dateUpdated": "2024-08-06T05:10:15.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-2293 (GCVE-0-2015-2293)

Vulnerability from cvelistv5 – Published: 2015-03-17 15:00 – Updated: 2024-08-06 05:10
VLAI?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:10:15.935Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpvulndb.com/vulnerabilities/7841"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://yoast.com/wordpress-seo-security-release/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
          },
          {
            "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
          },
          {
            "name": "1031920",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031920"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-03-17T14:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpvulndb.com/vulnerabilities/7841"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://yoast.com/wordpress-seo-security-release/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
        },
        {
          "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
        },
        {
          "name": "1031920",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031920"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-2293",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpvulndb.com/vulnerabilities/7841",
              "refsource": "MISC",
              "url": "https://wpvulndb.com/vulnerabilities/7841"
            },
            {
              "name": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
            },
            {
              "name": "https://yoast.com/wordpress-seo-security-release/",
              "refsource": "CONFIRM",
              "url": "https://yoast.com/wordpress-seo-security-release/"
            },
            {
              "name": "https://wordpress.org/plugins/wordpress-seo/changelog/",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
            },
            {
              "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
            },
            {
              "name": "1031920",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031920"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-2293",
    "datePublished": "2015-03-17T15:00:00",
    "dateReserved": "2015-03-14T00:00:00",
    "dateUpdated": "2024-08-06T05:10:15.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-16842 (GCVE-0-2017-16842)

Vulnerability from nvd – Published: 2017-11-16 03:00 – Updated: 2024-08-05 20:35
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:35:21.321Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/wordpress-seo/#developers"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-11-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-28T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wordpress.org/plugins/wordpress-seo/#developers"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-16842",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "https://packetstormsecurity.com/files/145080/WordPress-Yoast-SEO-Cross-Site-Scripting.html"
            },
            {
              "name": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php",
              "refsource": "MISC",
              "url": "https://plugins.trac.wordpress.org/changeset/1766831/wordpress-seo/trunk/admin/google_search_console/class-gsc-table.php"
            },
            {
              "name": "https://wordpress.org/plugins/wordpress-seo/#developers",
              "refsource": "MISC",
              "url": "https://wordpress.org/plugins/wordpress-seo/#developers"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-16842",
    "datePublished": "2017-11-16T03:00:00",
    "dateReserved": "2017-11-15T00:00:00",
    "dateUpdated": "2024-08-05T20:35:21.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-6692 (GCVE-0-2012-6692)

Vulnerability from nvd – Published: 2015-06-17 18:00 – Updated: 2024-08-06 21:36
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:36:01.882Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://yoast.com/wordpress-seo-2-2/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability"
          },
          {
            "name": "1032580",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1032580"
          },
          {
            "name": "75196",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75196"
          },
          {
            "name": "20150613 Yoast Wordpress SEO Plugin \u003c= 2.1.1 Stored, Authenticated XSS",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/Jun/40"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-10-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://yoast.com/wordpress-seo-2-2/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability"
        },
        {
          "name": "1032580",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1032580"
        },
        {
          "name": "75196",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75196"
        },
        {
          "name": "20150613 Yoast Wordpress SEO Plugin \u003c= 2.1.1 Stored, Authenticated XSS",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/Jun/40"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-6692",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html"
            },
            {
              "name": "https://yoast.com/wordpress-seo-2-2/",
              "refsource": "CONFIRM",
              "url": "https://yoast.com/wordpress-seo-2-2/"
            },
            {
              "name": "https://wordpress.org/plugins/wordpress-seo/changelog/",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
            },
            {
              "name": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/",
              "refsource": "MISC",
              "url": "https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/"
            },
            {
              "name": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability",
              "refsource": "MISC",
              "url": "https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability"
            },
            {
              "name": "1032580",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1032580"
            },
            {
              "name": "75196",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75196"
            },
            {
              "name": "20150613 Yoast Wordpress SEO Plugin \u003c= 2.1.1 Stored, Authenticated XSS",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/Jun/40"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-6692",
    "datePublished": "2015-06-17T18:00:00",
    "dateReserved": "2015-06-17T00:00:00",
    "dateUpdated": "2024-08-06T21:36:01.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-2292 (GCVE-0-2015-2292)

Vulnerability from nvd – Published: 2015-03-17 15:00 – Updated: 2024-08-06 05:10
VLAI?
Summary
Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:10:15.868Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpvulndb.com/vulnerabilities/7841"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://yoast.com/wordpress-seo-security-release/"
          },
          {
            "name": "36413",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/36413/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
          },
          {
            "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
          },
          {
            "name": "1031920",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031920"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-30T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpvulndb.com/vulnerabilities/7841"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://yoast.com/wordpress-seo-security-release/"
        },
        {
          "name": "36413",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/36413/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
        },
        {
          "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
        },
        {
          "name": "1031920",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031920"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-2292",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpvulndb.com/vulnerabilities/7841",
              "refsource": "MISC",
              "url": "https://wpvulndb.com/vulnerabilities/7841"
            },
            {
              "name": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
            },
            {
              "name": "https://yoast.com/wordpress-seo-security-release/",
              "refsource": "CONFIRM",
              "url": "https://yoast.com/wordpress-seo-security-release/"
            },
            {
              "name": "36413",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/36413/"
            },
            {
              "name": "https://wordpress.org/plugins/wordpress-seo/changelog/",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
            },
            {
              "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
            },
            {
              "name": "1031920",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031920"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-2292",
    "datePublished": "2015-03-17T15:00:00",
    "dateReserved": "2015-03-13T00:00:00",
    "dateUpdated": "2024-08-06T05:10:15.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-2293 (GCVE-0-2015-2293)

Vulnerability from nvd – Published: 2015-03-17 15:00 – Updated: 2024-08-06 05:10
VLAI?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:10:15.935Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpvulndb.com/vulnerabilities/7841"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://yoast.com/wordpress-seo-security-release/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
          },
          {
            "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
          },
          {
            "name": "1031920",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031920"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-03-17T14:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpvulndb.com/vulnerabilities/7841"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://yoast.com/wordpress-seo-security-release/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
        },
        {
          "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
        },
        {
          "name": "1031920",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031920"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-2293",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpvulndb.com/vulnerabilities/7841",
              "refsource": "MISC",
              "url": "https://wpvulndb.com/vulnerabilities/7841"
            },
            {
              "name": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html"
            },
            {
              "name": "https://yoast.com/wordpress-seo-security-release/",
              "refsource": "CONFIRM",
              "url": "https://yoast.com/wordpress-seo-security-release/"
            },
            {
              "name": "https://wordpress.org/plugins/wordpress-seo/changelog/",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/wordpress-seo/changelog/"
            },
            {
              "name": "20150312 WordPress SEO by Yoast \u003c= 1.7.3.3 - Blind SQL Injection",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/Mar/73"
            },
            {
              "name": "1031920",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031920"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-2293",
    "datePublished": "2015-03-17T15:00:00",
    "dateReserved": "2015-03-14T00:00:00",
    "dateUpdated": "2024-08-06T05:10:15.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}