CVE-2026-52702: WordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored Cross-Site Scripting (XSS) vulnerability in the SEO Redirection plugin for WordPress, affecting versions 9.17 and below. It is reachable over the network, requires no authentication, but does require a victim to interact with a crafted link or page. Successful exploitation allows an attacker to inject and run arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, or unauthorized actions taken on behalf of the victim. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a crafted HTTP request to the exposed WordPress installation.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerability is exploitable by any unauthenticated visitor.

• Victim interactionRequired

  A victim must follow a malicious link or visit a crafted page that triggers the injected script in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup beyond delivering the malicious payload to the victim.

Blast Radius

• An attacker executes arbitrary JavaScript in the victim's browser session, reading stored cookies including session tokens tied to the WordPress admin or logged-in user account.
• Confidential page content visible to the victim, such as draft posts, user profile data, or plugin configuration values, is exposed to the attacker-controlled script.
• The injected script can submit authenticated WordPress actions on behalf of the victim, modifying site content, creating accounts, or changing plugin settings.
• The integrity of the rendered page is compromised; the attacker can deface visible content or redirect the victim to a phishing site.