CVE-2026-116535

Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.4

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts by setting the display name parameter to a string containing the %%archive title%% token combined with HTML event-handler payloads. Because WordPress stores display names without HTML filtering and the plugin performs token substitution after escaping, the scripts execute when a user accesses the affected page.

Recommendations Update the plugin to version 10.4 or later. As a temporary mitigation, restrict the ability of users with subscriber-level access to modify the display name parameter.