Stored Cross-Site Scripting Vulnerability in Xagio SEO Plugin for WordPress

CVE-2025-3302

What is CVE-2025-3302?

The Xagio SEO plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of the 'HTTP_REFERER' parameter. This vulnerability impacts all versions up to and including 7.1.0.16, allowing unauthenticated attackers to embed malicious scripts into web pages. When users access the compromised pages, the injected scripts execute, potentially leading to unauthorized actions on behalf of the user. A partial fix was included in version 7.1.0.0, yet users are advised to ensure they are on the latest version to mitigate risks.

References