The SEOPress – On-site SEO & Analytics WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in its handling of social image URLs. Authenticated users with contributor-level or higher privileges can inject arbitrary web scripts because the plugin does not properly sanitize or escape these inputs before rendering them on pages. This flaw allows persistent script injection that executes in the context of users visiting the compromised pages. The vulnerability affects all plugin versions up to 7.9. No official patch or remediation details are provided in the available data.

An attacker with contributor-level or higher permissions can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the injected pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the victim's browser context. The impact is limited by the requirement for authenticated access with contributor or higher privileges, but the vulnerability still poses a risk to site users and administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting the use of social image URL inputs in the plugin. Monitor for plugin updates from rainbowgeek and apply any official patches promptly once released.