Loading vulnerability…
Stored XSS in WP Meta SEO via the Referer Header
CVE-2023-6961 is a stored cross-site scripting vulnerability in the WP Meta SEO plugin for WordPress affecting all versions through 4.5.12. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject JavaScript through the HTTP Referer header. The plugin stores the malicious header during redirect tracking, particularly for requests resulting in a 404 response. The injected script executes in an authenticated administrator's browser when the administrator opens the plugin's 404 & Redirects page. Active exploitation attempts have been observed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Injected JavaScript executes in the context of the affected WordPress site and can abuse an authenticated user's privileges. Potential consequences include session hijacking and credential theft. Observed exploitation payloads attempt to create administrator accounts, insert PHP backdoors into plugin and theme files, and track compromised websites, enabling persistent site compromise.
If you can’t patch tonight, do this now.
Review administrator accounts, inspect plugin and theme files for unexpected modifications or injected scripts, investigate suspicious outbound tracking requests, and remove suspicious plugin folders. These checks support detection and cleanup but do not replace installing the vulnerability patch.
Patch, then assume compromise.
Upgrade WP Meta SEO to a patched release. All versions through 4.5.12 are affected; the exact first fixed version is not specified in the available information. On potentially compromised installations, also investigate unauthorized administrator accounts and unexpected plugin or theme modifications, and remove malicious accounts, scripts, and backdoors.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.