Xagio Seo
Monthly
Cross-site request forgery in the Xagio SEO WordPress plugin (all versions up to and including 7.1.0.43) allows an unauthenticated attacker to make a logged-in user's browser submit a state-changing plugin request without a valid nonce or CSRF token. Because the request rides the victim's existing session, the practical impact is highest when the tricked user is a WordPress administrator, though our independent assessment bounds the effect to integrity-only, limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) rather than the 8.8 high-integrity/high-availability score in the CVE record. No public exploit identified at time of analysis, and no EPSS score was supplied with the source data; the vulnerability was reported by Patchstack and tracked as EUVD-2026-81519.
This is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Xagio SEO WordPress plugin that allows privilege escalation. The vulnerability affects Xagio SEO versions up to and including 7.1.0.30. An attacker can exploit this flaw to elevate their privileges within the affected WordPress installation, potentially gaining administrative access or performing unauthorized actions. No CVSS score, EPSS data, or KEV status information is currently available, and the vulnerability has not been confirmed as actively exploited in the wild.
Cross-site request forgery in the Xagio SEO WordPress plugin (all versions up to and including 7.1.0.43) allows an unauthenticated attacker to make a logged-in user's browser submit a state-changing plugin request without a valid nonce or CSRF token. Because the request rides the victim's existing session, the practical impact is highest when the tricked user is a WordPress administrator, though our independent assessment bounds the effect to integrity-only, limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) rather than the 8.8 high-integrity/high-availability score in the CVE record. No public exploit identified at time of analysis, and no EPSS score was supplied with the source data; the vulnerability was reported by Patchstack and tracked as EUVD-2026-81519.
This is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Xagio SEO WordPress plugin that allows privilege escalation. The vulnerability affects Xagio SEO versions up to and including 7.1.0.30. An attacker can exploit this flaw to elevate their privileges within the affected WordPress installation, potentially gaining administrative access or performing unauthorized actions. No CVSS score, EPSS data, or KEV status information is currently available, and the vulnerability has not been confirmed as actively exploited in the wild.