Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.

The WordPress Yoast SEO Plugin installed on the remote host is affected by multiple Cross-Site Request Forgery and multiple SQL Injection.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113460	Yoast SEO Plugin for WordPress 1.7.x < 1.7.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113459	Yoast SEO Plugin for WordPress 1.6.x < 1.6.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113458	Yoast SEO Plugin for WordPress < 1.5.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2015-2293

high

Tenable Plugins

critical

critical

critical