Executive brief
The SEO Redirection plugin for WordPress, which manages website URL redirects and 404 errors, contains a security flaw that allows attackers to inject malicious scripts into the site. If a site administrator or visitor interacts with a specially crafted link, the attacker can execute code in their browser, potentially leading to unauthorized actions or the theft of sensitive session information. This vulnerability could be used to deface the website or redirect users to malicious third-party sites.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the SEO Redirection plugin for WordPress (versions <= 9.17) due to improper neutralization of user-supplied input during web page generation (CWE-79). The flaw allows an unauthenticated remote attacker to inject malicious scripts into the application. Exploitation requires a victim (typically an administrator) to perform an action, such as clicking a malicious link (User Interaction: Required). Successful exploitation can lead to session hijacking, unauthorized administrative actions, or website defacement. The issue is resolved in version 9.18.
Affected products
- SEO Redirection Team SEO Redirection <= 9.17
Timeline
- 2026-05-05: other: Vulnerability reported by researcher dodoh4t
- 2026-06-12: advisory: Initial advisory published by Patchstack
- 2026-06-15: disclosed: CVE published in NVD
- 2026-06-12: patched: Fixed in version 9.18