CVE-2025-3302

High

Published: 11 June 2025

Published

11 June 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0192 83.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-3302 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other Platforms; in the Other ATLAS/OWASP Terms risk domain.

Deeper analysis

The Xagio SEO – AI Powered SEO plugin for WordPress contains a stored cross-site scripting vulnerability in all versions through 7.1.0.16. The flaw resides in the handling of the HTTP_REFERER parameter within the redirect logging components and stems from missing input sanitization combined with inadequate output escaping, allowing attacker-controlled values to be persisted and later rendered in administrative or logged pages.

Unauthenticated remote attackers can supply a malicious HTTP_REFERER header when requesting a site resource; the supplied payload is stored by the plugin and executes in the browser of any user who later views the affected log or redirect page, resulting in script execution with the privileges of that user.

The issue received a partial fix in version 7.1.0.0, with a subsequent changeset addressing remaining instances of the unsafe handling. The associated EPSS score has remained flat at 0.0192 with no material increase after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-18096

Vulnerability details

The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible…

for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.1.0.0.

CWE(s): CWE-79

AI Security AnalysisAI

AI Category: Other Platforms
Risk Domain: Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

T1555.003 Credentials from Web Browsers Credential Access

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

attack.mitre.org →

Why these techniques?

Stored XSS enables unauthenticated exploitation of a public-facing WordPress plugin (T1190), arbitrary JavaScript execution in victims' browsers (T1059.007), and credential theft via session cookies (T1539) or other browser credentials (T1555.003).