PT-2026-136848

CVE-2026-108041

Published

2026-11-04

Updated

2026-11-04

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SEOPress versions prior to 10.4

Description Insufficient sanitization and escaping of analytics tracking settings allow authenticated users with specific capabilities to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when the plugin outputs these settings into an inline script on every front-end page, enabling the execution of arbitrary web scripts in the browsers of site visitors, including logged-in administrators.

Recommendations Update to version 10.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers