The EONSR AEO Agent WordPress plugin versions up to 3.7.9 contain a stored XSS vulnerability (CWE-79) due to lack of authorization checks on one REST API route and disabled HTML sanitization when saving posts. This flaw enables unauthenticated attackers to inject arbitrary web scripts into administrator-attributed published posts, which execute in the context of any visitor's browser, including administrators. No CVSS score or patch information is currently available, and no known exploits in the wild have been reported.

An attacker can exploit this vulnerability to inject malicious scripts into posts that appear to be authored by administrators. These scripts execute in the browsers of site visitors and administrators, potentially leading to session hijacking, privilege escalation, or other malicious actions within the context of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API routes of the EONSR AEO Agent plugin and monitor for suspicious activity related to post creation. Avoid using affected versions in production environments if possible.