CVE-2025-58019
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Search Atlas SEO plugin for WordPress (versions up to and including 2.5.4) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's session, steal cookies, redirect the user, or perform actions on their behalf. This may lead to credential theft and privilege escalation.
Recommendation
Update the Search Atlas SEO plugin to a version newer than 2.5.4. Additionally, deploy CSP headers and regularly scan the site for malicious scripts.
Other vulnerabilities in Search Atlas SEO
See all- CVE-2026-57357High
The Search Atlas SEO plugin version 2.6.6 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-15247Medium
The Search Atlas SEO WordPress plugin before version 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers. This allows any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
- CVE-2026-15252Medium
The Search Atlas SEO WordPress plugin before 2.6.12 lacks capability and nonce checks in an AJAX handler, allowing any authenticated user (e.g., Subscriber) to invoke the Google Indexing API, submit or remove site URLs from Google's index, and consume the indexing quota.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 2.5.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS