CVE-2025-3302 is a stored cross-site scripting vulnerability in the Xagio SEO – AI Powered SEO WordPress plugin affecting all versions up to 7.1.0.16. The vulnerability is due to improper neutralization of input in the HTTP_REFERER parameter, which is not sufficiently sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject arbitrary scripts that execute in the context of users visiting the injected pages. Although a partial fix was implemented in version 7.1.0.0, the vulnerability remains in subsequent versions up to 7.1.0.16. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope changed.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to theft of sensitive information or session hijacking. The vulnerability impacts confidentiality and integrity but does not affect availability. No known active exploits have been reported.

No official patch or update is confirmed available beyond the partial fix in version 7.1.0.0. Users should verify if newer versions beyond 7.1.0.16 have addressed this issue by consulting the vendor's advisory or update channels. Until a full fix is confirmed, consider disabling or restricting use of the affected plugin to mitigate risk. Monitor vendor communications for official patches or updates.