SEOPress vulnerabilities

The SEOPress plugin for WordPress is vulnerable to stored cross-site scripting via author display name in versions up to and including 10.2. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content.

The SEOPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.

Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.