This vulnerability results from improper neutralization of input that is incorporated into web page output, allowing attackers to inject arbitrary JavaScript into the pages of the SEO Tools plugin. The reflected XSS flaw can be triggered by a crafted URL or form input and causes the victim’s browser to execute attacker-supplied code. Consequences include session hijacking, theft of credentials, defacement, and the ability to run further client‑side attacks.

The WordPress SEO Tools "seo-automatic-seo-tools" plugin by Dzynit, with all versions up through and including 4.0.7, is affected. No lower bound is specified, so every earlier release is also considered vulnerable.

The CVSS score of 7.1 indicates a high severity identified flaw. The EPSS score of less than 1% implies that exploitation is currently uncommon, and the vulnerability is not listed in CISA's KEV catalog, so it is not known to be actively exploited. The attack vector likely relies on the delivery of a malicious link or input to the vulnerable plugin, which is then reflected back to the victim’s browser. Attackers can target any user who visits the crafted URL, making the flaw broadly exploitable in the absence of mitigation.