WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging

An unauthenticated attacker can craft a URL containing malicious JavaScript in the `REQUEST_URI` (e.g., `/?"><script>alert(1)</script>`). When the server returns a 404, the plugin's `wpmsTemplateRedirect()` hook stores the full request URI (including the payload) into the database. The payload is later executed in the browser of any administrator who visits the plugin's 404 & Redirects admin page, because the stored value is output without escaping [CWE-79].

The vulnerability resides in the `wpmsTemplateRedirect()` hook within `wp-meta-seo.php`. When a 404 is detected, the code concatenates `$_SERVER['HTTP_HOST']` with the raw `$_SERVER['REQUEST_URI']` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `$wpdb->insert()` without any sanitization or escaping. The stored value is later rendered unsafely on the plugin's 404 & Redirects admin page (`/wp-admin/admin.php?page=metaseo_broken_link`).

The advisory does not include a published patch. To remediate, the plugin must sanitize or escape `$_SERVER['REQUEST_URI']` before inserting it into the database (e.g., using `sanitize_text_field()` or `esc_url_raw()`), and must escape the stored value when rendering it on the admin page (e.g., using `esc_url()` or `esc_html()`). Without these changes, an attacker can inject arbitrary HTML and JavaScript that executes in the admin context.