CVE-2026-53608

Name of the Vulnerable Software and Affected Versions @apostrophecms/seo versions prior to 1.4.3

Description Stored Cross-Site Scripting (XSS) occurs when the @apostrophecms/seo package injects the Google Analytics Tracking ID seoGoogleTrackingId and Google Tag Manager ID seoGoogleTagManager directly into <script> tag bodies using JavaScript template literals without sanitization or validation. Users with editor-level access, which is the default role for content managers, can set these variables to malicious values. This allows arbitrary JavaScript to execute in the browsers of all site visitors, potentially leading to session hijacking or theft of sensitive data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the seoGoogleTrackingId and seoGoogleTagManager fields to minimize the risk of exploitation.