Executive Summary

The WP Meta SEO plugin for WordPress has a vulnerability known as Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 4.5.18.

This vulnerability occurs because the plugin's `wpmsTemplateRedirect()` hook, when detecting a 404 error, concatenates the HTTP host with the raw request URI and inserts this combined value directly into the database without sanitization.

As a result, an unauthenticated attacker can inject malicious scripts via the REQUEST_URI server variable, which are then stored and executed whenever an administrator views the plugin's 404 & Redirects admin page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to execute arbitrary scripts in the context of an administrator's browser.

Such script execution can lead to theft of administrator credentials, session hijacking, or unauthorized actions performed with administrator privileges.

Because the attack is stored, the malicious script persists and triggers every time the affected admin page is viewed, increasing the risk of compromise.

Useful 0 Not Useful 0