SEO Redirection < 6.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads

PoC

Create a new Custom redirect (/wp-admin/options-general.php?page=seo-redirection.php) and set a payload such as /"> in the Redirect From and Redirect To fields