← back to popular plugins
wordfence / plugin · squirrly-seo

SEO Plugin by Squirrly SEO

squirrly-seo
total installs
40,000
total vulns
4
critical
0
high
0
medium
4
low
0
latest vuln
—
patched
4
unpatched
0
avg time to patch
—
vulnerabilities (4)
SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection
medium ✓ patched
cve id CVE-2025-14342 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Feb 18, 2026
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninstall function in all versions up to, and including, 12.4.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from Squirrly's cloud service.
SEO Plugin by Squirrly SEO <= 12.4.03 - Authenticated (Contributor+) SQL Injection
medium ✓ patched
cve id CVE-2025-22783 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Mar 27, 2025
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 12.4.03 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter
medium ✓ patched
cve id CVE-2025-1768 ↗
cvss score 6.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Mar 6, 2025
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
SEO Plugin by Squirrly SEO <= 12.4.07 - Missing Authorization
medium ✓ patched
cve id CVE-2025-24654 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Mar 3, 2025
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 12.4.07. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.