Hello,

Plugin: SEO Redirection 2.8 https://wordpress.org/plugins/seo-redirection/

1. Reflected Cross-Site Scripting (XSS) 

Authenticated administrators can inject html/js code (there is no CSRF protection).

Method: GET

Url: http://localhost/wp-admin/options-general.php?page=seo-redirection.php&tab=posts&search=[xss]

Vulnerable parameters: search

Example PHP callstack:

/seo-redirection/options/option_page_post_redirection_list.php:46

Verification:

Identical XSSs are also in:

option_page_404.php (param search) /seo-redirection/options/option_page_404.php:51

option_page_history.php (param search) /seo-redirection/options/option_page_404.php:43