The vulnerability is a stored XSS flaw that allows an attacker with administrator rights to inject arbitrary HTML or JavaScript into the plugin’s settings page. The flaw originates from the 'Permanent keywords' input field, which accepts raw user data, stores it unsanitized, and outputs it back in a textarea without escaping. When script payloads are entered, a closing </textarea> tag can terminate the element and the script executes in the context of any visitor who views the settings page. The weakness is CWE‑79.

All released versions of the eazyserver Sentence To SEO plugin up to version 1.0 are affected. The plugin is a WordPress add‑on that manages keywords, descriptions, and tags. Any WordPress site that has installed this plugin and has an administrator or higher level account is vulnerable. No later versions are mentioned, so sites may still be using the legacy 1.0 build.

The CVSS score for this issue is 4.4, indicating a moderate risk. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. The attack requires a web‑based interaction with the plugin’s settings page and holds the precondition of administrator authentication. If an attacker can log into the site as an admin, they can immediately create malicious content that will affect all subsequent visitors to the settings page.