CVE-2026-78295: WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Xagio SEO pluginto a version that resolves this vulnerability.Fixed in 7.1.0.44
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using Xagio SEO version 7.1.0.43 or earlier are affected according to the available information. The vulnerability is described as unauthenticated CSRF, so the attacker does not need to authenticate to the site before initiating the attack.
What does an attacker need to exploit it?
The CVSS vector indicates network-based exploitation with low attack complexity and required user interaction. This means an attacker would need to cause a user to interact with a malicious request; the provided data does not identify which user role or plugin action is involved.
How can I determine whether my site is affected?
Check whether Xagio SEO is installed and identify its installed version. Sites running version 7.1.0.43 or earlier should be treated as affected based on the advisory data.