Siteseo Vulnerabilities

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers...

CVSS:

4.3

Affected:

up to 1.3.2

Fixed in:

1.3.3

Disclosed:

Nov 18, 2025

CVE-2025-13085 on NVD →

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, who have been granted access to at least on Sit...

CVSS:

5.3

Affected:

up to 1.3.2

Fixed in:

1.3.3

Disclosed:

Nov 18, 2025

CVE-2025-12814 on NVD →

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level access and above, to en...

CVSS:

4.3

Affected:

up to 1.3.1

Fixed in:

1.3.2

Disclosed:

Oct 31, 2025

CVE-2025-12367 on NVD →

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVSS:

6.4

Affected:

up to 1.2.7

Fixed in:

1.2.8

Disclosed:

Aug 26, 2025

CVE-2025-9277 on NVD →