CVE-2025-25158

Vulnerability

Overview The Uncomplicated SEO plugin for WordPress, versions up to and including 1.2, is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user input during page generation [1]. This allows an attacker to inject arbitrary web scripts or HTML into a page.

Exploitation

To exploit this vulnerability, an attacker would need to trick a privileged user (such as an administrator) into clicking a malicious link or visiting a crafted page. The attack does not require authentication but depends on user interaction. Once triggered, the injected script executes in the context of the victim's browser [1].

Impact

Successful exploitation could allow an attacker to perform actions such as redirecting visitors, displaying advertisements, or stealing sensitive information like session tokens. This can compromise the security and integrity of the WordPress site [1].

Mitigation

The vendor has not released an official patch as of the publication date. However, immediate action is recommended: update the plugin if a patched version becomes available. Alternatively, consider using a security plugin like Patchstack to block attacks until an official fix is applied [1].