Stored Cross-Site Scripting Vulnerability in SEOPress WordPress Plugin
CVE-2026-108041
Key Information:
Badges
What is CVE-2026-108041?
The SEOPress WordPress plugin prior to version 10.4 has a flaw that allows for Stored Cross-Site Scripting attacks. This occurs because the plugin fails to properly sanitize and escape certain analytics tracking settings before embedding them in an inline script across all front-end pages. Users with specific SEOPress capabilities, which can be assigned by an administrator to lower-privileged roles, can exploit this vulnerability to inject malicious scripts. As a result, site visitors, including logged-in administrators, may inadvertently execute harmful scripts in their browsers.
Affected Version(s)
SEOPress 0 < 10.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.