The Complete Google Seo Scan plugin for WordPress is vulnerable to SQL injection due to improper neutralization of special characters in SQL commands as defined by CWE‑89. If an attacker can control the input fields processed by the plugin, they could modify the structure of the SQL query, enabling unauthorized reading, modification, or deletion of database records. The vulnerability is rated with a CVSS score of 7.6, indicating significant risk to confidentiality and integrity of the site’s data.

Nir's Complete Google Seo Scan WordPress plugin up to and including version 3.5.1 is affected. The plugin is deployed via the WordPress administrative interface, handling search‑engine‑related inputs. Any WordPress installation using these versions that has the plugin activated is at risk.

The EPSS score of < 1% provides a low probability of exploitation, as the numeric value indicates an exploitation likelihood below one percent. The CVSS score of 7.6 reflects the high severity should exploitation occur. The plugin has not appeared in CISA’s KEV catalog. The likely attack vector is inferred from the plugin’s use of user‑supplied input in frontend or admin pages; an attacker could inject SQL through crafted requests or form submissions. Exploitation would grant the attacker read or write access to the WordPress database, potentially exposing user data, content, or configuration details.