Cross Site Scripting Flaw in SEO Plugin by Squirrly SEO
CVE-2026-66614

7.1HIGH

Key Information:

Vendor

WordPress
Status
Seo Plugin By Squirrly Seo
Vendor
CVE Published:
20 August 2026

What is CVE-2026-66614?

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the SEO Plugin by Squirrly SEO, affecting versions up to 14.2.2. This flaw can allow attackers to inject malicious scripts into web pages, potentially compromising user data and site integrity. Users of the affected plugin are advised to update to a secure version to mitigate possible exploit risks.

Affected Version(s)

SEO Plugin by Squirrly SEO <= 14.2.2

References

https://patchstack.com/database/wordpress/plugin/squirrly...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo | Patchstack Bug Bounty Program
.