CVE-2026-101357

Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the seopress google analytics matomo id parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. This issue is exploitable only if an administrator has delegated the Analytics management capability to the Subscriber role through the plugin's Advanced > Security settings.

Recommendations Update the plugin to version 10.3 or later. Restrict the Analytics management capability to higher-privileged roles within the Advanced > Security settings to prevent lower-level users from accessing the vulnerable parameter.