CVE-2025-3302 – The Xagio SEO WordPress plugin has a stored XSS... (How to Fix)

Q: What is the severity of CVE-2025-3302?

CVE-2025-3302 has a CVSS score of 7.2 (HIGH). The Xagio SEO WordPress plugin has a stored XSS vulnerability in all versions up to 7.1.0.16. Unauthenticated attackers can inject malicious scripts via the HTTP_REFERER parameter, which execute when users visit compromised pages. WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

The Xagio SEO WordPress plugin has a stored XSS vulnerability in all versions up to 7.1.0.16. Unauthenticated attackers can inject malicious scripts via the HTTP_REFERER parameter, which execute when users visit compromised pages. WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

Xagio SEO – AI Powered SEO WordPress plugin

Versions: All versions up to and including 7.1.0.16

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: WordPress sites with the vulnerable plugin installed and active are affected regardless of configuration.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal admin credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.

🟠

Likely Case

Attackers inject malicious scripts to steal user session cookies, redirect visitors to phishing sites, or display unwanted content.

🟢

If Mitigated

With proper web application firewalls and input validation, impact is limited to script execution in user browsers without server compromise.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability requires no authentication and exploitation is straightforward via HTTP requests with malicious referer headers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 7.1.0.17 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3281174/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Xagio SEO plugin. 4. Click 'Update Now' if available. 5. If not, download latest version from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Xagio SEO plugin until patched

Web Application Firewall rule

all

Block or sanitize HTTP_REFERER headers containing script tags

🧯 If You Can't Patch

Implement Content Security Policy (CSP) headers to restrict script execution
Use WordPress security plugins with XSS protection features

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Xagio SEO version. If version is 7.1.0.16 or lower, you are vulnerable.

Check Version:

wp plugin list --name=xagio-seo --field=version

Verify Fix Applied:

After updating, verify plugin version is 7.1.0.17 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual HTTP_REFERER values containing script tags or JavaScript in WordPress logs
Multiple 404 errors with suspicious referer headers

Network Indicators:

HTTP requests with malicious script content in Referer header
Outbound connections to unknown domains after page visits

SIEM Query:

source="wordpress.log" AND ("HTTP_REFERER" AND ("<script" OR "javascript:" OR "onerror=" OR "onload="))

📊 Metadata

CVE ID: CVE-2025-3302

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.49% exploit probability (64.8th percentile)

Published: June 11, 2025

Last Updated: June 12, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-3302, you might also want to check these: