CVE-2025-3302: Xagio SEO WordPress Plugin XSS Flaw

CVE-2025-3302 Overview

CVE-2025-3302 is a stored Cross-Site Scripting (XSS) vulnerability in the Xagio SEO – AI Powered SEO plugin for WordPress. The flaw affects all versions up to and including 7.1.0.16 and stems from insufficient input sanitization and output escaping of the HTTP_REFERER request header. Unauthenticated attackers can inject arbitrary web scripts that execute when users access an injected page. The vulnerability was partially patched in version 7.1.0.0 [CWE-79]. The plugin's 404 logging functionality stores attacker-controlled referer data without proper neutralization, which is later rendered in administrative pages.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress admin contexts, enabling session theft, administrative action hijacking, and arbitrary site modification.

Affected Products

Xagio SEO – AI Powered SEO plugin for WordPress (all versions ≤ 7.1.0.16)
WordPress sites with Xagio SEO redirects/404 logging module enabled
Plugin file modules/redirects/models/xagio_log404.php

Discovery Timeline

2025-06-11 - CVE-2025-3302 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3302

Vulnerability Analysis

The vulnerability resides in the Xagio SEO plugin's 404 logging component. When a visitor requests a non-existent URL, the plugin captures request metadata, including the HTTP_REFERER header, and writes it to the plugin's database. Because the HTTP_REFERER value is attacker-controlled and is neither sanitized on input nor escaped on output, any HTML or JavaScript payload supplied in that header is persisted verbatim.

When an administrator or other authenticated user later views the 404 log within the WordPress admin dashboard, the unescaped referer value is rendered into the page DOM. The browser executes the stored script in the privileged origin of the WordPress site, allowing the attacker's payload to operate with the viewing user's authority.

Root Cause

The root cause is improper neutralization of input during web page generation. The affected code paths in xagio_log404.php and redirects.js read the HTTP_REFERER header into storage and emit it back into administrative pages without applying functions such as esc_html(), esc_attr(), or wp_kses(). The partial fix in 7.1.0.0 did not fully eliminate the unsanitized rendering paths, requiring a follow-up changeset.

Attack Vector

The attack requires no authentication and no user interaction with the attacker. An attacker issues an HTTP request to any URL on the target WordPress site that triggers the plugin's 404 logger, setting the Referer header to a malicious payload such as a <script> tag or an event-handler-bearing element. The payload is stored and later activated whenever a user visits the page that renders the log entry. See the Wordfence Vulnerability Analysis and the WordPress Xagio Log404 Code for the affected sink locations.

No verified public exploit code is available. The vulnerability mechanism follows the standard stored XSS pattern: attacker-controlled header → unsanitized database write → unescaped output in an authenticated browsing context.

Detection Methods for CVE-2025-3302

Indicators of Compromise

HTTP requests to the WordPress site containing <script>, onerror=, onload=, or javascript: substrings within the Referer header.
Rows in the Xagio plugin's 404 log table containing HTML tags or JavaScript syntax in the referer column.
Unexpected outbound requests from administrator browsers to attacker-controlled domains immediately after visiting the Xagio redirects/404 admin page.
WordPress admin user sessions exhibiting unauthorized actions such as new administrator account creation or plugin installation.

Detection Strategies

Inspect web server access logs for Referer header values containing HTML special characters (<, >, ", ') targeting URLs likely to generate 404 responses.
Query the Xagio plugin database tables for stored referer values matching XSS payload signatures.
Deploy Content Security Policy (CSP) reporting to surface unexpected inline script execution within /wp-admin/ pages.
Monitor the WordPress audit trail for administrator actions originating from the Xagio plugin pages.

Monitoring Recommendations

Enable Web Application Firewall (WAF) rules that inspect and normalize the Referer header before requests reach WordPress.
Alert on any administrator login followed by privilege changes within a short window after visiting Xagio admin screens.
Retain at least 90 days of HTTP request logs to support retrospective hunting for stored payloads injected before detection was in place.

How to Mitigate CVE-2025-3302

Immediate Actions Required

Update the Xagio SEO plugin to a version released after 7.1.0.16 that fully addresses the HTTP_REFERER sanitization gap.
If no fixed version is available, deactivate and remove the Xagio SEO plugin until a complete patch ships.
Purge existing 404 log entries that may contain stored XSS payloads before any administrator opens the affected admin pages.
Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected.

Patch Information

The vendor released partial fixes tracked in WordPress Xagio Plugin Changeset 3281174 and WordPress Xagio Plugin Changeset 3305780. Version 7.1.0.0 introduced a partial patch but did not fully remediate the issue across all sinks. Administrators should install the latest available version from the Xagio SEO WordPress Plugin page and verify the changelog covers CVE-2025-3302.

Workarounds

Disable the Xagio redirects/404 logging module if the plugin must remain installed.
Deploy a WAF rule that strips or rejects HTML metacharacters in the Referer header on requests to the WordPress site.
Restrict access to /wp-admin/ to known IP ranges to limit which sessions can render stored payloads.
Enforce a strict Content Security Policy in the WordPress admin that disallows inline scripts and untrusted script sources.

bash

# Example nginx rule to drop requests with script tags in the Referer header
if ($http_referer ~* "(<|%3C)\s*script") {
    return 403;
}