The SEO Plugin by Squirrly SEO for WordPress contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject malicious scripts via the plugin's admin settings, which are then stored and executed when other users access the injected pages. This vulnerability affects multi-site installations or installations with unfiltered_html disabled, across all versions up to 12.3.15. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges without user interaction. No patch or remediation details are provided in the available data.

An attacker with administrator-level permissions can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability and requires high privileges and a multi-site or restricted HTML configuration to be exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the vulnerable plugin in multi-site or restricted HTML environments. Monitor vendor channels for updates or patches addressing this vulnerability.