Skip to content
OpenAdvisories

Vendor

cifi

9 known vulnerabilities.

Products

SEO Plugin by Squirrly SEO 5 Starbox – the Author Box for Humans 3 GEO Plugin by Squirrly SEO 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-7624

    SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo…

    cifi SEO Plugin by Squirrly SEO Web / CMS
  • Medium 4.3
    CVE-2025-14342

    SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninstall function in all versions up to, and including, 12.4.14. This makes it possible for authenticated …

    cifi SEO Plugin by Squirrly SEO Web / CMS
  • Medium 6.5
    CVE-2025-1768

    SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…

    cifi SEO Plugin by Squirrly SEO Web / CMS
  • Medium 6.4
    CVE-2023-6806

    Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings

    The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

    cifi Starbox – the Author Box for Humans Web / CMS
  • Medium 6.4
    CVE-2024-0256

    Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings

    The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for a…

    cifi Starbox – the Author Box for Humans Web / CMS
  • Medium 4.3
    CVE-2024-0366

    Starbox – the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference

    The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This makes it possible for s…

    cifi Starbox – the Author Box for Humans Web / CMS
  • Medium 4.4
    CVE-2024-0597

    SEO Plugin by Squirrly SEO <= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 12.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…

    cifi SEO Plugin by Squirrly SEO Web / CMS