Server-Side Request Forgery in Xagio SEO Plugin for WordPress

CVE-2025-14438

What is CVE-2025-14438?

The Xagio SEO plugin for WordPress is exposed to a Server-Side Request Forgery (SSRF) vulnerability through the 'pixabayDownloadImage' function. This issue allows authenticated attackers with Subscriber-level access or higher to send requests to arbitrary locations from within the web application. Such malicious requests can enable attackers to retrieve or manipulate internal service data, posing a significant risk to the integrity and confidentiality of the affected system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References