CVE-2012-6692: wordpress wordpress-seo Cross-site Scripting
Vulnerability summary
CVE-2012-6692 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in wordpress wordpress-seo. EPSS estimates a 3.18% chance of exploitation in the next 30 days, higher than 87.9% of scored vulnerabilities. 4 public exploits are recorded. Fixed in 2.2.
Timeline
- 17-06-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
3.18%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
Decrease -0.02 pp
From 3.21% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
4 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (inventropy.us)
Maturity: unknown
Exploit Reference (wordpress.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Wordpress1 product
- wordpress-seo≤ 2.1.1 (fixed in 2.2)
Yoast1 product
- wordpress_seo≤ 2.1.1
2 vendors · 2 products
References
9 links- packetstormsecurity.com/files/132294/WordPress-Yoast-2.1.1-Cross-Site-Scripting.htmlX Refsource MISCExploit
- yoast.com/wordpress-seo-2-2/X Refsource CONFIRM
- wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerabilityX Refsource MISCExploit