CVE-2025-10357
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-14
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | simple_seo | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored Cross-Site Scripting (XSS) issue in the Simple SEO WordPress plugin versions before 2.0.32. It occurs because the plugin does not properly sanitize and escape certain parameters when displaying them on the page. This flaw allows users with a Contributor role or higher to inject malicious scripts into the site, which can then be executed by other users viewing the affected pages. [1]
How can this vulnerability impact me? :
The vulnerability can allow an attacker with Contributor-level access to inject malicious scripts into the website. This can lead to unauthorized actions such as stealing user session cookies, defacing the website, redirecting users to malicious sites, or performing other malicious activities within the context of the affected site. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to inject the known XSS payload into the HTML-encoded SEO Title field within the Simple SEO tab of a new post in the WordPress plugin Simple SEO (versions prior to 2.0.32). For detection, you can create a new post as a user with Contributor role or higher and insert the payload `"><script></script><img src=x onerror=alert(777)>` into the SEO Title field to see if the script executes. There are no specific network commands provided, but manual testing within the WordPress admin interface is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Simple SEO WordPress plugin to version 2.0.32 or later, where the issue has been fixed by properly sanitizing and escaping parameters. Additionally, restrict the permissions of users with Contributor roles if possible until the update is applied. [1]