The vulnerability arises from a faulty regular expression in the preg_replace call that fails to sanitize user input and escape output. This flaw permits an authenticated Contributor or higher level user to embed arbitrary JavaScript into plugin configuration pages. When another user opens the affected page, the injected script runs in their browser context. The impact is client‑side code execution that can lead to session hijacking, credential theft, or defacement of the site. The weakness matches CWE‑79, a classic reflected or stored XSS scenario.

WordPress installations running the SiteSEO – SEO Simplified plugin with version 1.2.7 or earlier are affected. The flaw exists only in the source code of those releases and is not present in newer versions released after 1.2.7.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at this time. Because the attack requires legitimate Contributor or higher authentication, an attacker must first compromise a user’s credentials or gain access through an existing account. The plugin is not listed in the CISA KEV catalog, further reducing the immediate threat posture for most environments.