The Allegro Marketing hpb seo plugin for WordPress versions up to 3.0.1 contains a CSRF vulnerability that enables reflected XSS attacks. This occurs because the plugin does not adequately verify the origin of requests, allowing attackers to trick authenticated users into executing unwanted actions. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS v3.1 base score is 7.1, indicating high severity with impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow attackers to execute unauthorized actions within the context of an authenticated user session, potentially leading to reflected XSS attacks. This can compromise user data confidentiality, integrity, and availability of the affected WordPress site. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the hpb seo plugin or restricting its use to trusted users only. Monitor vendor channels for updates regarding patches or official mitigations.