CVE-2026-116535
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The SEOPress plugin for WordPress (up to 10.3) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access to inject arbitrary scripts that execute when a user visits an injected page. The payload uses the %%archive_title%% token with HTML, and the plugin substitutes the token after escaping.
Risk Assessment
A low-privileged attacker can execute arbitrary JavaScript in the browser of a user visiting the infected page, potentially leading to session theft or other actions in the site context. This may also affect administrators viewing the pages.
Recommendation
Update the plugin to a version later than 10.3. Until then, consider restricting the ability of low-privileged users to change their display_name.
Other vulnerabilities in SEOPress
See all- CVE-2026-96564High
The SEOPress plugin for WordPress is vulnerable to stored cross-site scripting via author display name in versions up to and including 10.2. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content.
- CVE-2026-101357Medium
The SEOPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.
- CVE-2026-85305Medium
Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.
Original NVD description (English source)
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber who sets their display_name to a string containing the literal %%archive_title%% token alongside HTML event-handler payloads, as WordPress stores display names without HTML filtering and the plugin substitutes the token after escaping has already occurred.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS