The SEOReseller Partner sr‑partner plugin contains a CSRF vulnerability that allows an attacker to inject arbitrary scripts which are then stored by the site and executed in the browsers of all users who view the affected content. This stored cross‑site scripting leads to potential data theft, defacement, or session hijacking for visitors of the compromised WordPress site.

The vulnerability affects the WordPress SEOReseller Partner plugin (sr‑partner) from all available releases through version 1.3.15. Anyone running this plugin in this version range on a WordPress installation must consider the plugin in use and apply a fix.

The vulnerability carries a CVSS score of 7.1 and an extremely low EPSS score (<1%). It is not listed in the CISA KEV catalog. Exploitation would require forming a CSRF request that triggers the plugin’s data‑saving endpoint, which typically requires administrative credentials or an authenticated user. Once triggered, the stored malicious script can execute whenever page content is rendered, affecting confidentiality, integrity, and availability of the site.