SEO Plugin by Squirrly SEO vulnerabilities

The SEO Plugin by Squirrly SEO in versions <= 14.2.5 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.

Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO up to version 14.2.0, allowing an unauthenticated attacker to inject malicious scripts into pages.

The SEO Plugin by Squirrly SEO for WordPress up to version 12.4.16 contains an authorization bypass vulnerability. Authenticated attackers with contributor-level access or higher can invoke privileged Squirrly cloud API operations, such as revoking Google Search Console and Google Analytics integrations, which are normally restricted to administrators with the sq_manage_settings capability.