The GZSEO WordPress plugin contains missing capability checks on several AJAX handlers and fails to sanitize or escape the embed_code parameter. As a result, any authenticated user with contributor-level access or higher can inject malicious JavaScript into a post. When a visitor loads the affected page, the script runs in their browser, potentially stealing credentials, defacing content, or redirecting users to fraudulent sites.

Vulnerable versions are all releases of the GZSEO plugin up to and including 2.0.11. The vendor is aminhashemy and the product is the GZSEO WordPress plugin. No other vendors or products are listed as affected.

The CVSS score of 6.4 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests low expected exploitation frequency, and the flaw is not catalogued in CISA’s KEV list. Exploitation requires legitimate contributor credentials, but once authenticated, an attacker can send a crafted AJAX request with malicious embed_code payload. The attack vector is therefore an authenticated web request, and the impact can compromise the integrity of content displayed to all site visitors.