CVE-2025-63025

MediumCVSS 4.3

Published: 09/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Missing Authorization vulnerability in Xagio SEO Xagio SEO xagio-seo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Xagio SEO: from n/a through <= 7.1.0.37.

Risk Assessment

An attacker may gain access to functions or data they should not have permissions for, potentially leading to modification of SEO settings or other unauthorized actions.

Recommendation

Update the Xagio SEO plugin to a version newer than 7.1.0.37 that fixes this vulnerability.

Other vulnerabilities in Xagio SEO

CVE-2026-78295High
The Xagio SEO plugin in versions up to and including 7.1.0.43 contains an Unauthenticated Cross Site Request Forgery (CSRF) vulnerability. The lack of CSRF protection allows an attacker to force a logged-in user to perform unwanted actions.

Original NVD description (English source)

Missing Authorization vulnerability in Xagio SEO Xagio SEO xagio-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xagio SEO: from n/a through <= 7.1.0.37.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS