EUVD-2025-18096
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionNVD
The Xagio SEO - AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.1.0.0.
AnalysisAI
The Xagio SEO plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 7.1.0.16 that allows unauthenticated attackers to inject malicious scripts via the HTTP_REFERER parameter. When users access pages containing injected payloads, the scripts execute in their browsers, potentially enabling session hijacking, credential theft, or malware distribution. The vulnerability was only partially patched in version 7.1.0.0, indicating that complete mitigation requires upgrading to a version beyond 7.1.0.16.
Technical ContextAI
This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'), a foundational web application security weakness. The HTTP_REFERER parameter, typically set by browsers in HTTP headers to indicate the referring page, is being captured and stored in the WordPress database without sufficient input sanitization. Upon retrieval and display in the plugin's administrative or frontend interfaces, the parameter is not properly HTML-escaped or sanitized before output, allowing malicious JavaScript to execute in the context of the affected WordPress site. The 'Stored' variant is particularly severe because the payload persists in the database, affecting all subsequent users who view the injected content, rather than requiring the attacker to craft individual phishing URLs. CPE string for affected product: cpe:2.7a:xagio:xagio_seo:*:*:*:*:*:wordpress:*. The vulnerability affects all versions up to and including 7.1.0.16.
RemediationAI
primary_action: Update to the latest patched version beyond 7.1.0.16 (version number not specified in provided data; check Xagio official repository or WordPress plugin page for latest available version); interim_mitigation: ['Disable the Xagio SEO plugin immediately if patched version is unavailable', 'Implement Web Application Firewall (WAF) rules to block or sanitize HTTP_REFERER parameters containing script tags and JavaScript patterns', 'Configure WordPress security plugins to monitor for stored XSS patterns in plugin data', 'Audit database records for existing malicious payloads in fields where HTTP_REFERER is stored']; patch_verification: After updating, verify the patch by testing with common XSS payloads in HTTP_REFERER (e.g., '<script>alert(1)</script>') to confirm proper escaping and sanitization; vendor_resources: Check Xagio official website, WordPress plugin security advisories, and the plugin's update mechanism for patch availability and detailed remediation guidance
Share
External POC / Exploit Code
Leaving vuln.today