Slim SEO vulnerabilities
3 known CVE vulnerabilities in Slim SEO, translated and rated.
- CVE-2026-62113Medium
The Slim SEO plugin in versions up to and including 4.10.0 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they do not have permission to.
- CVE-2026-57429Medium
The Slim SEO plugin versions up to 4.6.2 contain a vulnerability involving broken access control for contributors. A user with the contributor role can gain unauthorized access to SEO management functions.
- CVE-2026-12408Medium
The Slim SEO plugin for WordPress up to version 4.9.8 contains a vulnerability allowing unauthorized disclosure of private content. The issue is in the REST API endpoint `/wp-json/slim-seo/meta-tags/ai`, which does not properly verify user permissions to read a specific post, enabling authenticated attackers with Contributor-level access or higher to retrieve summaries of any post's content, including private, draft, pending, future, and password-protected posts.