CVE-2022-1628: Simple SEO <= 1.7.91 - Authenticated (Contributor+) Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-06 · updated 2026-06-17
Weakness: CWE-79

Description

The Simple SEO plugin for WordPress is vulnerable to attribute-based stored Cross-Site Scripting in versions up to, and including 1.7.91, due to insufficient sanitization or escaping on the SEO social and standard title parameters. This can be exploited by authenticated users with Contributor and above permissions to inject arbitrary web scripts into posts/pages that execute whenever an administrator access the page.

Affected products

David Cole Simple SEO (WordPress plugin): through 1.7.91

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2754807%40cds-simple-seo&new=2754807%40cds-simple-seo&sfp_email=&sfph_mail=
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1628
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2754807%40cds-simple-seo&new=2754807%40cds-simple-seo&sfp_email=&sfph_mail=
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1628

Get alerted when CVE-2022-1628 or the next vulnerability affects your stack