CVE-2024-1168: 
WordPress vulnerability analysis and mitigation

The SEOPress – On-site SEO WordPress plugin was identified with a Stored Cross-Site Scripting vulnerability (CVE-2024-1168) affecting all versions up to 7.9. The vulnerability was discovered and reported by researcher vgo0 (Wordfence Intel).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue that can be exploited through the plugin's social image URL functionality. The vulnerability requires at least Contributor-level authentication to exploit. The severity of this vulnerability has been assessed with a CVSS score of 6.4, indicating a medium severity level (Wordfence Intel).

When successfully exploited, this vulnerability could allow authenticated attackers with Contributor or higher privileges to store and execute malicious JavaScript code through the social image URL feature, potentially affecting site administrators and other users who access the affected areas of the WordPress installation (Wordfence Intel).

Website administrators running the SEOPress plugin should update to a version newer than 7.9 as soon as possible to address this vulnerability. Until the update can be applied, it is recommended to review and limit user roles with access to the social image URL functionality (Wordfence Intel).