DELUCKS SEO plugin for WordPress contains an improper neutralization of input during web page generation, allowing stored cross‑site scripting. In the vulnerable versions, unsanitized data entered through the plugin’s configuration or post metadata is saved and later rendered directly into web pages. Attacks that succeed can inject and execute arbitrary scripts in the browsers of site visitors, potentially exposing session cookies, hijacking user sessions, defacing content, or loading malicious third‑party resources.

All WordPress sites that have the DELUCKS SEO plugin installed on any version up to 2.5.9, including 2.5.9 itself, are affected. No version higher than 2.5.9 is known to contain the flaw.

It has a CVSS score of 6.5, indicating a medium impact. The EPSS score is under 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves unauthenticated or authenticated users submitting input via the plugin’s administrative interface that is later stored; the attacker does not need to compromise the server but merely supply malicious payloads that the plugin stores and renders. Exploitation requires the ability to insert data into the plugin’s configuration or content fields, which may be limited to admins or contributors depending on the site’s role configuration.