CVE-2023-1669highCWE-502

CVE-2023-1669: high-severity vulnerability in SEOPress

SEOPress < 6.5.0.3 - Admin+ PHP Object Injection

Published · Updated

Follow this CVE+ Monitor SEOPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 18%
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · SEOPress
Related CVEs — SEOPress

In the same product, most dangerous first.

CVE-2024-5488CRITICALSEOPress < 7.9 - Unauthenticated Object InjectionEPSS 3.7%CVE-2023-6290MEDIUMWP SEO Press < 7.3 - Admin+ Stored XSSEPSS 0.4%CVE-2024-4899MEDIUMSEOPress < 7.8 - Contributor+ Stored XSSEPSS 0.3%CVE-2024-4900MEDIUMSEOPress < 7.8 - Contributor+ Open RedirectEPSS 0.3%CVE-2026-108041HIGHSEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking SettingsEPSS 0.3%