The SEO Links Interlinking WordPress plugin contains a reflected cross‑site scripting vulnerability in the google_error parameter. The plugin fails to adequately sanitize or escape this parameter, allowing an attacker to supply arbitrary JavaScript that is reflected back to the user's browser when the victim follows a crafted link. This flaw results in client‑side script execution without requiring authentication.

Any WordPress site running the SEO Links Interlinking plugin version 1.7.9.9.1 or earlier is affected. The vulnerability is present in all releases up to and including 1.7.9.9.1 and is distributed by seomantis through the official WordPress plugin repository.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1 % suggests that exploitation attempts are infrequent in the current threat landscape. The vulnerability is not listed in CISA’s KEV catalog. An attacker does not need authentication; delivery of a malicious URL containing a crafted google_error value via phishing or social engineering is sufficient. If a victim clicks on this link, the injected script runs in the context of the victim’s browser session.