A reflected cross-site scripting vulnerability in the SEO Pyramid plugin for WordPress allows unauthenticated attackers to execute arbitrary scripts in the context of a victim's session.

This is a reflected cross-site scripting (XSS) vulnerability (CWE-79) caused by improper neutralization of user-supplied input. An unauthenticated attacker can craft malicious URLs that, when visited by an authenticated administrator or user, execute unauthorized scripts within the web application.

Successful exploitation of this vulnerability could lead to session hijacking, unauthorized actions performed on behalf of a user, or the redirection of users to malicious websites. Given the CVSS score of 7.4, this vulnerability represents a high risk to the confidentiality and integrity of web application sessions, potentially resulting in reputational damage or compromised administrative control over the WordPress environment.

Immediate Action: Since a specific patched version is currently unknown, administrators should immediately deactivate and uninstall the SEO Pyramid plugin until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests containing script tags or suspicious URL parameters directed at the SEO Pyramid plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common XSS attack patterns targeting the application.

Public Exploit Available: Unknown.

The high severity of this vulnerability necessitates immediate attention, as it allows for unauthenticated interaction with potentially privileged user sessions. Given the lack of a verified patch, the most effective mitigation is the removal of the vulnerable software component from the production environment until the vendor provides a secure, updated version.