Learn how effective pillar pages and clustered content improve site structure, internal linking, and on-page SEO.
The third edition of Ranking Factors is finally here! It got a little makeover both in looks and content inside. And, for the first time, we’ve put all the factors into a sortable sheet to find the info you need, faster.
With CallRail’s VP of Product, Jason Tatum, we will also cover the past and future state of phone calls, and how you can use AI to gain valuable insights that will transform your business. 
Dive into the future of paid search and explore the trends, strategies, and technologies that will shape the search marketing landscape.
Dive into the future of paid search and explore the trends, strategies, and technologies that will shape the search marketing landscape.
With CallRail’s VP of Product, Jason Tatum, we will also cover the past and future state of phone calls, and how you can use AI to gain valuable insights that will transform your business. 
All In One SEO WordPress plugin versions up to and including 4.2.9 are vulnerable to stored cross-site scripting attacks
The United States National Vulnerability Database published an advisory about two vulnerabilities discovered in the All In One SEO WordPress plugin.
All In One SEO (AIOSEO) plugin, which has over three million active installations, is vulnerable to two Cross-site scripting (XSS) attacks.
The vulnerabilities affect all versions of AIOSEO up to and including version 4.2.9.
Cross-site scripting (XSS) attacks are a form of injection exploit that involves malicious scripts executing in a user’s browser which then can lead to access to cookies, user sessions and even a site takeover.
The two most common forms of Cross-Site Scripting attacks are:
A Reflected XSS relies on sending a script to a user who clicks on it, which goes to the vulnerable site which then “reflects” the attack back at the user.
A Stored XSS is when the malicious script is on the vulnerable site itself.
Hackers take advantage of any form of input to the website like a contact form, image upload form, any area where someone can upload or make a submission.
The vulnerability arises when there are insufficient security checks to block unwanted inputs.
The two issues affecting the AIOSEO plugin are both Stored Cross-Site Scripting vulnerabilities.
Vulnerabilities are assigned numbers to keep track of them. The first one was assigned, CVE-2023-0585.
This vulnerability arises from a failure to sanitize inputs. This means that insufficient filtering is done to prevent a hacker from uploading a malicious script.
The National Vulnerability Database (NVD) notice describes it like this:
“The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping.
This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”
The vulnerability was assigned a threat level of 4.4 (out of ten), which is a medium level.
An attacker must first acquire administrator privileges or higher to perpetrate this attack.
This attack is similar to the first one. The main difference is that an attacker needs to assume at least a contributor level of website access privilege.
A contributor level role has the ability to create content but not to publish it.
The vulnerability is also a medium level threat but it is assigned a higher vulnerability score of 6.4.
This is the description:
“The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping.
This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”
The first vulnerability requires administrator level privileges and is assigned a relatively low medium threat level score of 4.4.
But the second vulnerability only requires a lower level of privilege and is rated higher at 6.4.
It’s generally a good policy to update all vulnerable plugins. AIOSEO plugin version 4.3.0 is the one containing the security fix, referred to in the official AIOSEO changelog as additional “security hardening.”
Read details of the two vulnerabilities:
CVE-2023-0585
CVE-2023-0586
Featured image by Shutterstock/Bangun Stock Productions
Roger Montti is a search marketer with over 20 years experience. I offer site audits and phone consultations.  See me ...
Conquer your day with daily search marketing news.
Join Our Newsletter.
Get your daily dose of search know-how.
In a world ruled by algorithms, SEJ brings timely, relevant information for SEOs, marketers, and entrepreneurs to optimize and grow their businesses -- and careers.
Copyright © 2023 Search Engine Journal. All rights reserved. Published by Alpha Brand Media.

source