The Sentence To SEO (keywords, description and tags) plugin is vulnerable because the create_admin_page() function does not properly validate a security nonce. This flaw allows an unauthenticated attacker to forge a request that updates plugin settings, inserting arbitrary JavaScript that is then stored and executed whenever the settings page is rendered. The vulnerability is a classic CSRF‑to‑stored‑XSS chain, with the potential to compromise the confidentiality, integrity, or availability of the site and its visitors.

WordPress sites that run the Sentence To SEO plugin by eazyserver, version 1.0 and all earlier releases. The affected product is packaged as the WordPress plugin named Sentence To SEO (keywords, description and tags). No specific patch version information is included in the CNA data, so all instances of the vulnerable plugin need to be examined.

This issue carries a CVSS score of 6.1, indicating moderate severity. EPSS data is not available, but the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a cross‑site request forgery: an attacker crafts a link or form that an active administrator clicks, causing the admin’s browser to submit a request to update the plugin settings. Because the nonce verification is missing, the request succeeds, and the stored script executes in future page loads. As the flaw is unauthenticated and relies on an admin’s interaction, an attacker who can persuade or trick site owners can elevate the risk to arbitrary users of the affected WordPress site.