EIP-2026-113518

The advisory details a stored XSS vulnerability in the 404 to 301 WordPress Plugin, where user-controlled input (Referer and User-Agent headers) is not properly escaped in the admin logs. An attacker can inject malicious scripts, which execute when an admin views the logs.