The Uncomplicated SEO plugin for WordPress contains an improperly sanitized input that enables reflected XSS. Malicious content inserted into the plugin’s query parameters is rendered without escaping, allowing an attacker to execute arbitrary JavaScript in the browser of any user who views the affected page. This can lead to session hijacking, credential theft, defacement or the execution of further client‑side attacks. The weakness is a classic example of CWE‑79 – Improper Neutralization of Input.

All installations of the Antonio Sanchez Uncomplicated SEO plugin with a version of 1.2 or earlier are vulnerable. The issue was present from the initial release and remains affected through version 1.2.

The CVSS score of 7.1 and an EPSS probability of less than 1‑percent suggest that the flaw is not actively exploited on a large scale today and it is not listed in CISA’s KEV catalog. Nevertheless, attackers can exploit it by embedding malicious JavaScript into crafted URLs or form inputs that are reflected by the plugin. Once an attacker successfully injects code, the impact spans confidentiality, integrity, and availability of the site’s visitors, but the vulnerability requires only a standard HTTP request and does not need privileged access to the server.