PT-2025-25204 · WordPress · Xagio Seo

Jack Taylor

·

Published

2025-06-11

·

Updated

2025-06-11

·

CVE-2025-3302

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Xagio SEO – AI Powered SEO plugin for WordPress versions up to, and including, 7.1.0.16
Description The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP REFERER parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Recommendations For versions up to, and including, 7.1.0.16, update to a version later than 7.1.0.16 to resolve the issue. As a temporary workaround, consider restricting access to the HTTP REFERER parameter until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3302

Affected Products

Xagio Seo