The Maniac SEO plugin contains an improper neutralization of input that allows a reflected XSS. When a user visits a specially crafted URL containing malicious script code in certain query parameters or form fields, the plugin echoes the input back without encoding, enabling script execution in the victim’s browser. Attackers can use this to hijack sessions, steal authentication cookies, redirect users, or modify the page content. The weakness is a classic input validation error (CWE‑79).

Agora32’s Maniac SEO WordPress plugin, version 2.0 or earlier. Site owners running any enabled instance of this plugin with the vulnerable version are at risk.

The CVSS score of 7.1 places this vulnerability in the high severity range, but the EPSS score of less than 1% indicates that the probability of exploitation is low at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only a crafted link or form input, meaning the attack vector can be remote and does not require authentication. Because it is a reflected XSS, it is easily exploitable through social engineering or content injection by malicious parties. The impact is limited to the user context in which the script runs, but can lead to credential theft or defacement.