The vulnerability is a Cross‑Site Request Forgery that allows an attacker to inject malicious script content that is stored and later served to other site users. An exploited payload could store code in a post, link, or plugin configuration, enabling theft of credentials, session hijacking, or defacement. This stored XSS weakness permits code execution in the browsers of any visitors who view the vulnerable content.

Michael Lups: SEO Flow by LupsOnline plugin for WordPress, versions up to and including 2.2.1 are vulnerable. The issue impacts any site running this plugin where the vulnerable version is installed.

The CVSS score of 7.1 rates the vulnerability as medium severity. The EPSS score is below 1 %, indicating a low probability of exploitation at this time, and the issue is not listed in CISA’s KEV catalogue. The likely attack vector is a CSRF request that an authenticated WordPress user might unknowingly submit, after which the malicious script is stored and executed whenever other visitors view the affected content.