CVE-2024-6497

Deeper analysis

The SEO Plugin by Squirrly SEO for WordPress contains a stored cross-site scripting vulnerability in the url parameter that affects all versions through 12.3.19. The flaw stems from insufficient input sanitization and output escaping, allowing malicious script content to be persisted and later rendered in plugin-generated pages. CVE-2024-43286 is noted as a duplicate of the same issue.

Authenticated users with Contributor-level access or higher can supply crafted url values that store executable scripts. When any visitor loads an affected page the injected code runs in the victim's browser, enabling theft of session tokens, account takeover, or other actions within the WordPress site context. The reported CVSS 3.1 score is 8.8.

Public references point to a patched changeset (3121853) in the plugin repository and an advisory from Wordfence that recommend updating to a fixed release. Site administrators should apply the latest version of the Squirrly SEO plugin and verify that Contributor roles cannot create or edit content that bypasses the corrected escaping routines.

EPSS probability rose from lower values to a recorded peak of 0.2757 before receding to the current 0.2289, indicating measurable post-disclosure exploitation interest that warrants renewed monitoring.