Melquisedeq Ortiz

**Name of the Vulnerable Software and Affected Versions** WP Meta SEO versions prior to 4.5.19 **Description** Unauthenticated Stored Cross-Site Scripting occurs when the `wpmsTemplateRedirect()` hook detects a 404 error. The plugin concatenates `$ SERVER['HTTP HOST']` with the raw `$ SERVER['REQUEST URI']` and inserts the value into the `wp wpms links.link url` column using `$wpdb->insert()`. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator accesses the 404 & Redirects admin page at the endpoint '/wp-admin/admin.php?page=metaseo broken link'. **Recommendations** Update to a version newer than 4.5.18.