hpb seo CVE-2025-60075

Exploitation requires (1) the target site to run the Allegro Marketing hpb seo plugin for WordPress at version <= 3.0.1 where the affected action lacks a CSRF nonce/token, and (2) a victim with an active, usually authenticated WordPress session to be socially engineered into visiting an attacker-controlled page or clicking a crafted link (UI:R). The forged request causes attacker-controlled input to be reflected and executed as script in that victim's browser. Key limiting factors: it is non-persistent reflected XSS (impact is per-victim, not stored), it cannot be triggered without user interaction, it only affects sites with this specific niche plugin installed, and the low EPSS plus absence of public exploit code further constrain realistic exploitation.

This is a moderate-severity (CVSS 7.1) CSRF-to-reflected-XSS issue in an obscure WordPress plugin, and the combined signals point to LOW real-world priority. EPSS is just 0.13% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified - all three exploitation-likelihood signals agree on low urgency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) looks alarming because of the network vector and scope change, but the UI:R requirement is decisive: exploitation needs a victim with an active WordPress session to be tricked into clicking an attacker-controlled link, which makes mass or automated exploitation impractical. The impacts are only Low across C/I/A, consistent with reflected (non-persistent) XSS confined to a single victim's browser rather than server compromise. Note one nuance to verify: the CVSS carries PR:N (reported as unauthenticated by Patchstack/NVD), yet CSRF against an SEO-management plugin typically targets an authenticated administrator - the 'unauthenticated' label describes the attacker, not the victim, who usually must be logged in. Overall this is a high-CVSS-but-low-real-risk item that can be patched on a normal cycle rather than treated as an emergency.

An attacker crafts a malicious web page or email link and lures a logged-in WordPress user of a site running hpb seo <= 3.0.1 into visiting it. Because the plugin lacks CSRF protection, the forged request is processed and attacker-supplied script is reflected back and executed in the victim's browser session. No public exploit code was identified at time of analysis, so a would-be attacker would need to develop the request themselves.