This vulnerability allows an attacker without authentication to store malicious script code in the database by exploiting the plugin’s handling of a 404 request. When an administrator visits the plugin’s 404 & Redirects admin page, the unsanitized content stored from REQUEST_URI will be executed in the admin context, permitting arbitrary JavaScript execution, defacement, or credential theft. The weakness is a classic Stored Cross‑Site Scripting (CWE‑79) that compromises the integrity and confidentiality of the site.

All releases of WP Meta SEO by joomunited from 4.5.0 through 4.5.18 are affected.

The CVSS score of 7.2 classifies it as High. EPSS data is not available, so exploitation probability cannot be quantified, but the issue is not listed in CISA KEV. Attack does not require authentication but relies on fostering a 404 condition by visiting a crafted URL. Once a malicious entry is stored, any user who subsequently views the plugin’s 404 & Redirects page will have the script executed, making it a serious risk for site administrators.