Skip to content
Sign in
4.4 Medium

CVE-2024-0657 The Internal Link Juicer: SEO Auto Linker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site…

Description

The Internal Link Juicer: SEO Auto Linker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as 'ilj_settings_field_links_per_page' in all versions up to, and including, 2.23.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Affected products and versions

Product Affected versions Fixed in
Internal Link Juicer: SEO Auto Linker for WordPress 2.23 earliest → 2.23.4 No fix stated

Other CVEs of Internal Link Juicer: SEO Auto Linker for WordPress

The 3 CVEs of Internal Link Juicer: SEO Auto Linker for WordPress →
CVE-2024-13362 Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in… 6.1 Medium CVE-2022-4974 The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request… 6.3 Medium
Track this CVE