SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS

Vulnerability

The Squirrly SEO WordPress plugin (SEO Plugin by Squirrly SEO) before version 12.3.21 contains a Stored Cross-Site Scripting (XSS) vulnerability. An editor-level user can embed a malicious script into the plugin's input fields, which is then stored and executed in the context of other users' browsers [1].

Exploitation

To exploit this vulnerability, an attacker needs to have Editor-level access to the WordPress site. The attacker injects a malicious JavaScript payload into a vulnerable input field of the Squirrly SEO plugin. When an administrator or other privileged user views the affected content, the script executes, potentially allowing the attacker to hijack the session or perform actions on behalf of the victim [1].

Impact

Successful exploitation leads to Stored XSS, which can result in account takeover. An attacker can execute arbitrary JavaScript in the context of the victim's browser, potentially stealing cookies, session tokens, or performing actions as the victim. This can lead to full compromise of the WordPress site if the victim is an administrator [1].

Mitigation

The vulnerability is fixed in version 12.3.21 of the Squirrly SEO plugin. Users should update to the latest version immediately. No workarounds are documented [1].