The SEOPress – On-site SEO plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in URL query arguments. Specifically, the plugin uses add_query_arg and remove_query_arg functions without appropriate escaping, enabling attackers to inject malicious scripts via crafted URLs. This vulnerability affects all versions up to and including 8.1.1. Exploitation requires tricking a user into clicking a malicious link, leading to script execution in the user's browser context. The CVSS 3.1 base score is 6.1, indicating a medium severity impact with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a crafted link. This can lead to partial disclosure of confidential information and integrity loss within the affected web application context. There is no indication of availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links received from untrusted sources. Monitoring vendor channels for updates and applying patches promptly once available is recommended.