Stored Cross-Site Scripting Vulnerability in EONSR AEO Agent WordPress Plugin
CVE-2026-11588
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 August 2026
Badges
What is CVE-2026-11588?
The EONSR AEO Agent plugin for WordPress prior to version 3.7.9 is vulnerable due to inadequate authorization checks on specific REST API routes. This security flaw allows unauthenticated attackers to craft and publish posts with malicious web scripts. These scripts are stored on the server and executed in the browser of any user visiting the affected site, which includes administrative users. This effectively leads to unauthorized access and data manipulation, posing a significant risk to the integrity and security of affected websites.
Affected Version(s)
EONSR AEO Agent 0 <= 3.7.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.