[SECURITY - NEWS] XSS Vulnerability Patched in SEOPress Affects 100,000 sites

SOURCE:

There will not be serious problems, but it is still useful to update.

Thank You @Roger Marquez

only works if you allow registrations on the site. the attacker at least needs a valid user account (subscriber level is the minimum).
so if you have a blog without allowing registrations it can't be exploited.

Laplace said:

There will not be serious problems, but it is still useful to update.

Click to expand...

well if you allow users to register then it could be harmful. someone could hijack all traffic, or push malware etc. as javascript can be injected and you can do a lot of things with js.
in combination with other bugs it could even lead to full compromise of the site/server.