The Metadata SEO plugin contains an improper neutralization of user input during web page generation, allowing stored cross‑site scripting attacks. When an attacker succeeds, arbitrary JavaScript can execute in a victim’s browser, potentially compromising user sessions, injecting malicious content, or facilitating further phishing attempts.

WordPress users running the Metadata SEO plugin, version 2.3 or earlier, are affected.

With a CVSS score of 6.5, this vulnerability is considered medium severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at present, and it is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user submitting unchecked input through the plugin’s configuration or content fields, which is then stored and rendered without sanitization for all site visitors.