{"id":"CVE-2021-24976","aliases":["EUVD-2021-11888","GHSA-555p-jhmj-xhrc"],"status":"published","title":"Smart SEO Tool \u003c 3.0.6 - Reflected Cross-Site Scripting","description":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00917,"percentile":0.60458,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-01-24T08:01:02Z","modified":"2026-06-17T03:41:15Z","products":[{"vendor":"unknown","product":"smart seo tool – seo优化插件"},{"vendor":"wbolt","product":"smart_seo_tool"}],"references":[{"url":"https://wpscan.com/vulnerability/7d5f58a8-bee4-46be-9c08-d272678338f0","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/2637305","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24976"},{"url":"https://github.com/advisories/GHSA-555p-jhmj-xhrc"}],"sources":{"cve":[{"id":"CVE-2021-24976","title":"Smart SEO Tool \u003c 3.0.6 - Reflected Cross-Site Scripting","description":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting","status":"published","published":"2022-01-24T08:01:02Z","modified":"2024-08-03T19:49:14.366Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:05.331617Z"}],"euvd":[{"id":"EUVD-2021-11888","description":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting","status":"published","published":"2022-01-24T08:01:02Z","modified":"2024-08-03T19:49:14Z","updated_at":"2026-11-03T03:24:54.862767Z"}],"ghsa":[{"id":"GHSA-555p-jhmj-xhrc","title":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search...","description":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting","status":"published","published":"2022-01-25T00:01:39Z","modified":"2023-02-03T05:05:08Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:53:41.500507Z"}],"nvd":[{"id":"CVE-2021-24976","description":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting","status":"published","published":"2022-01-24T08:15:09.043Z","modified":"2026-06-17T03:41:15.033Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:03.821385Z"}]}}