Cross‑Site Request Forgery in the ZMSEO plugin allows an attacker to inject malicious script into the site’s content. The injected script then persists in the database and executes automatically whenever a user views the affected page, leading to session hijack, defacement, or credential theft. The weakness relies on improper validation of request tokens, mapped to CWE‑352.

The ZMSEO WordPress plugin, version 1.14.1 and earlier, is impacted. Administrators who use this plugin on any WordPress site may be vulnerable if they do not keep the plugin updated.

The vulnerability has a CVSS score of 7.1 and an EPSS score of less than 1 %, indicating a low probability of widespread automated exploitation but still a moderate to high impact if exploited. The attack vector is inferred to be a CSRF attack targeting authenticated administrators; the attacker must entice the victim to visit a crafted URL or submit a forged request. Because the vulnerability is not listed in CISA KEV, there is no known active exploitation, but the presence of stored XSS remains a significant risk.