https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 11:03:49 +0000 https://cve.radiocsirt.org/vuln/cve-2026-9643 <p><strong>Affected:</strong> joomunited WP Meta SEO</p> <p>The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin&#39;s `wpmsTemplateRedirect()` hook detects a 404, it concatenates `$_SERVER[&#39;HTTP_HOST&#39;]` with the raw `$_SERVER[&#39;REQUEST_URI&#39;]` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `$wpdb-&gt;insert()`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the plugin&#39;s 404 &amp; Redirects admin page (`/wp-admin/admin.php?page=metaseo_broken_link`).</p> <p><strong>Affected:</strong> joomunited WP Meta SEO</p> <p>The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin&#39;s `wpmsTemplateRedirect()` hook detects a 404, it concatenates `$_SERVER[&#39;HTTP_HOST&#39;]` with the raw `$_SERVER[&#39;REQUEST_URI&#39;]` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `$wpdb-&gt;insert()`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the plugin&#39;s 404 &amp; Redirects admin page (`/wp-admin/admin.php?page=metaseo_broken_link`).</p> https://cve.radiocsirt.org/vuln/cve-2026-9643