CVE-2026-1667

Name of the Vulnerable Software and Affected Versions SEO Plugin by Squirrly SEO versions prior to 14.0.1

Description This issue allows unauthenticated attackers to create arbitrary posts due to an API token leak and insufficient input sanitization and output escaping. Additionally, if the Advanced Custom Fields plugin is active, attackers can perform Stored Cross-Site Scripting (XSS)—a technique where malicious scripts are permanently stored on the target server—by injecting web scripts into pages that execute when accessed by a user.

Recommendations Update to a version later than 14.0.0.