Xagio vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Xagio products: 1 record(s), with severity, exploitation and fixes.

Xagio SEO – AI Powered SEO 1

Exploited only (KEV) →

CVE-2025-14438 Medium · 6.4 CWE-918 Jan 6, 2026

Xagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request Forgery

The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixabayDownloadImage' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.