| Package | Affected versions | Patched versions |
|---|---|---|
| keyword meta | ≤ 3.0 |
The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free