What is the CVSS score of CVE-2025-3302?

CVE-2025-3302 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.9%.

Which versions of PHP are affected by CVE-2025-3302?

The Xagio SEO plugin contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into WordPress pages.

How to fix or mitigate CVE-2025-3302?

Within 24 hours: Inventory all WordPress installations running Xagio SEO plugin and document affected versions. Within 7 days: Implement WAF rules to block malicious referer header patterns and disable the Xagio SEO plugin if not critical to operations pending remediation. Within 30 days: Monitor vendor releases for a complete patch and apply immediately upon availability; alternatively, migrate to an alternative SEO plugin if remediation timeline is unacceptable.

PHP CVE-2025-3302

EUVD-2025-18096 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-11 security@wordfence.com

WordPress XSS PHP

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2025-18096

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

CVE Published

Jun 11, 2025 - 12:15 nvd

HIGH 7.2

DescriptionCVE.org

The Xagio SEO - AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.1.0.0.

AnalysisAI

The Xagio SEO plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 7.1.0.16 that allows unauthenticated attackers to inject malicious scripts via the HTTP_REFERER parameter. When users access pages containing injected payloads, the scripts execute in their browsers, potentially enabling session hijacking, credential theft, or malware distribution. The vulnerability was only partially patched in version 7.1.0.0, indicating that complete mitigation requires upgrading to a version beyond 7.1.0.16.

Technical ContextAI

This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'), a foundational web application security weakness. The HTTP_REFERER parameter, typically set by browsers in HTTP headers to indicate the referring page, is being captured and stored in the WordPress database without sufficient input sanitization. Upon retrieval and display in the plugin's administrative or frontend interfaces, the parameter is not properly HTML-escaped or sanitized before output, allowing malicious JavaScript to execute in the context of the affected WordPress site. The 'Stored' variant is particularly severe because the payload persists in the database, affecting all subsequent users who view the injected content, rather than requiring the attacker to craft individual phishing URLs. CPE string for affected product: cpe:2.7a:xagio:xagio_seo:*:*:*:*:*:wordpress:*. The vulnerability affects all versions up to and including 7.1.0.16.

RemediationAI

primary_action: Update to the latest patched version beyond 7.1.0.16 (version number not specified in provided data; check Xagio official repository or WordPress plugin page for latest available version); interim_mitigation: ['Disable the Xagio SEO plugin immediately if patched version is unavailable', 'Implement Web Application Firewall (WAF) rules to block or sanitize HTTP_REFERER parameters containing script tags and JavaScript patterns', 'Configure WordPress security plugins to monitor for stored XSS patterns in plugin data', 'Audit database records for existing malicious payloads in fields where HTTP_REFERER is stored']; patch_verification: After updating, verify the patch by testing with common XSS payloads in HTTP_REFERER (e.g., '<script>alert(1)</script>') to confirm proper escaping and sanitization; vendor_resources: Check Xagio official website, WordPress plugin security advisories, and the plugin's update mechanism for patch availability and detailed remediation guidance