The Xagio SEO – AI Powered SEO plugin for WordPress contains a stored cross‑site scripting vulnerability. The flaw stems from unsanitized input taken from the HTTP_REFERER header and stored in the plugin’s log files without proper escaping. An attacker who can set a crafted HTTP_REFERER value can cause arbitrary JavaScript to be written to page output for any visitor who later loads a page that references the logged entry. Consequently, a user’s browser will execute the injected code, enabling attackers to steal session cookies, deface content, or launch further attacks. The weakness is a classic input‑validation failure documented as CWE‑79.

This flaw affects the Xagio SEO – AI Powered SEO WordPress plugin in all releases up to and including version 7.1.0.16. The author partially addressed the issue in version 7.1.0.0, but a full fix requires upgrading beyond that minor release. WordPress sites that have installed any vulnerable edition of the plugin are potentially exposed.

The CVSS score of 7.2 indicates high severity, while the EPSS score of 2 % suggests a modest but present likelihood of exploitation. The flaw is non‑authenticated and does not require privileged access, making it relatively easy to trigger. The vulnerability is not currently listed in CISA’s KEV catalog, but because it writes data to a persistent log that is later rendered without escaping, attackers can exploit it via normal page navigation after sending the malicious referer header. Until the plugin is upgraded, users remain at risk of script injection and the attendant privacy and operational consequences.