CVE-2026-19988
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A cross-site scripting vulnerability has been detected in Alaev SEO Tools Extension up to version 1.0.10 for Chrome in the addDiv function of file src/popup.html (Popup UI component). Manipulation leads to basic XSS. The attack can be initiated remotely, and the exploit is publicly available. The vendor was contacted but did not respond.
Risk Assessment
XSS vulnerability in a browser extension could allow an attacker to execute scripts in the extension's context, potentially leading to data theft or extension takeover.
Recommendation
It is recommended to update the extension to a patched version or remove it if no patch is available. Also, avoid using extensions without active vendor support.
Original NVD description (English source)
A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.