CVE-2019-13478

Published: Jul 9, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.

Affected (5)

Products: Yoast: Yoast Seo

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Yoast Yoast Seo	Before 11.6
Yoast Yoast Seo	Version 11.6 rc1
Yoast Yoast Seo	Version 11.6 rc2
Yoast Yoast Seo	Version 11.6 rc3
Yoast Yoast Seo	Version 11.6 rc4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/Yoast/wordpress-seo/releases/tag/11.6-RC5

Source: cve@mitre.org

Release Notes

https://wpvulndb.com/vulnerabilities/9445

Source: cve@mitre.org

Third Party Advisory

https://github.com/Yoast/wordpress-seo/releases/tag/11.6-RC5

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://wpvulndb.com/vulnerabilities/9445

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.