CVE-2026-78295Wordfence

Vulnerability Summary

The Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.0.43. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity Level

MEDIUM(4.3)

Published Date

Sep 17, 2026

Last Modified

Sep 22, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.14%Probability

Root Weakness (CWE)

CWE-352: Cross-Site Request Forgery (CSRF) ↗

The web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVSS v3.1 Base Metrics — Score 4.3 (MEDIUM)

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeUnchanged

ConfidentialityNone

IntegrityLow

AvailabilityNone

Affected & Patched Versions

Affected Versions

Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility * - 7.1.0.43

Patched Versions

Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility 1

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.