Read the docs
TI-2024-06026 Aliases CVE-2024-6497GHSA-r2j9-gh64-cp47

SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter

Priority MEDIUM 53CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection, Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89 and CWE-79.

Summary

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 12.3.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-43286 appears to be a duplicate of this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.10969 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cifiSEO Plugin by Squirrly SEOup to 12.3.19—No fix listedCNA
  • SEO Plugin by Squirrly SEO Vendorcifi Affected up to 12.3.19 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:squirrly:seo_plugin_by_squirrly_seo:*:*:*:*:*:wordpress:*:*before 12.3.20Vulnerablecifi
  • cpe:2.3:a:squirrly:seo_plugin_by_squirrly_seo:*:*:*:*:*:wordpress:*:* Versions before 12.3.20 Vulnerable ·cifi

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6497
  2. 2026-10-03 Alias added: GHSA-r2j9-gh64-cp47

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2024-09739 SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS CVSS 3.1LOW 3.5
  • TI-2025-16664 WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.03 - SQL Injection vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-28938 WordPress Squirrly SEO plugin <= 12.3.19 - SQL Injection vulnerability CVSS 3.1HIGH 8.8
  • TI-2022-17844 WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload CVSS 3.1HIGH 8.8
  • TI-2025-18371 WordPress Squirrly SEO plugin <= 12.4.07 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-27759 WordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL Injection CVSS 3.1HIGH 7.6
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences