Stored Cross-Site Scripting Vulnerability in Xagio SEO Plugin for WordPress

CVE-2025-3302

What is CVE-2025-3302?

The Xagio SEO plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of the 'HTTP_REFERER' parameter. This vulnerability impacts all versions up to and including 7.1.0.16, allowing unauthenticated attackers to embed malicious scripts into web pages. When users access the compromised pages, the injected scripts execute, potentially leading to unauthorized actions on behalf of the user. A partial fix was included in version 7.1.0.0, yet users are advised to ensure they are on the latest version to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References