The Seo Monster WordPress plugin accepts requests to the check_integration() function without properly validating a nonce, enabling an attacker to forge a request that updates plugin settings and injects malicious scripts. This flaw allows an unauthenticated attacker to trick a privileged administrator into executing a link, after which the attacker can store scripts that will run in the context of any site visitor, compromising confidentiality and integrity of the website’s content. The vulnerability is classified as a CSRF (CWE‑352), resulting in a medium‑severity risk.

All WordPress sites running the Seo Monster plugin up to and including version 3.3.3 are affected. The plugin, provided by edsteep:<Seo Monster>, is designed to integrate SEO features; users who have installed any prior to 3.3.4 remain vulnerable.

The CVSS score of 6.1 reflects a medium impact that is attainable through social‑engineering in a non‑authenticated context. With an EPSS score of less than 1%, the likelihood of opportunistic exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack path is clear: an attacker crafts a forged request, bypasses nonce checks, changes a setting to contain a malicious script, and lures an administrator into triggering the request. Once executed, the injected script is stored and served to all site visitors, potentially enabling phishing, data theft, or further site compromise.