The Alaev SEO Tools Extension for Chrome, versions 1.0.0 through 1.0.10, contains a basic cross-site scripting vulnerability in the addDiv function of the src/popup.html file within the Popup UI component. This vulnerability allows remote attackers to inject malicious scripts via manipulation of the affected function, potentially leading to execution of arbitrary scripts in the context of the extension. The vulnerability requires user interaction to be exploited. The vendor was contacted but did not provide any response or patch. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official remediation or patch has been published as of the date of this report.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected browser extension, potentially leading to unauthorized actions or data exposure within the extension's privileges. However, exploitation requires user interaction and the vulnerability does not involve privilege escalation or system-level compromise. There is no evidence of active exploitation in the wild.

No official patch or remediation is currently available from the vendor. Users should consider disabling or uninstalling the Alaev SEO Tools Extension until a fix is released. Avoid interacting with suspicious content that could trigger the vulnerability. Monitor vendor channels for updates or patches.