Authenticated stored XSS via unsanitized redirect fields

Cross-site scripting in SEO Redirection Plugin – 301 Redirect Manager before 6.4 allows remote authenticated users to execute script via crafted redirect fields. The dashboard redirect-creation handler stores Redirect From and Redirect To values without sanitization, permitting a high-privilege user to persist script payloads even when unfiltered_html is disabled. Exploitation requires authenticated administrative-level access and another user to load the affected dashboard or redirect content; impact is limited to script-driven confidentiality and integrity effects in that browser context.