CVE-2025-12814mediumCWE-285

CVE-2025-12814: falha de média gravidade em softaculous SiteSEO – SEO Simplified

SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SiteSEO – SEO Simplified

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, who have been granted access to at least on SiteSEO setting capability, to reset the plugin's settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
softaculous · SiteSEO – SEO Simplified
CVEs relacionadas — softaculous SiteSEO – SEO Simplified

No mesmo produto, das mais perigosas para as menos.

CVE-2025-13085MEDIUMSiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta DisclosureEPSS 0.3%CVE-2025-12367MEDIUMSiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings UpdateEPSS 0.2%CVE-2025-9277MEDIUMSiteSEO – SEO Simplified <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex ExpressionEPSS 0.2%