Technical impact
The Bulk NoIndex & NoFollow Toolkit plugin fails to escape user data before rendering it into a web page. The unfiltered data is echoed back to the victim’s browser, allowing an attacker to embed JavaScript in the response. By delivering a crafted link to a user, an attacker can run arbitrary code in the victim’s context, potentially hijacking sessions, defacing site content, or redirecting the user to malicious sites.
Affected Systems
WordPress sites that have the Bulk NoIndex & NoFollow Toolkit plugin from madfishdigital installed in a vulnerable version (≤ 2.16). The impact is on any visitor to those sites.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity, and the EPSS score of less than 1 % shows a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted URL that passes unescaped input to the plugin; an attacker can lure a user to the malicious link to trigger the reflected XSS attack. No authentication is required to exploit the flaw.
EUVD