CVE-2026-11588

Name of the Vulnerable Software and Affected Versions EONSR AEO Agent WordPress plugin versions prior to 3.8.0

Description The plugin fails to perform authorization checks on a REST API route and disables HTML sanitization before saving posts. This allows unauthenticated attackers to create published posts attributed to administrators that contain arbitrary web scripts. These scripts execute in the browser of any visitor, including administrators, resulting in Stored Cross-Site Scripting (Stored XSS), which is a vulnerability where malicious scripts are permanently stored on the target server.

Recommendations Update the EONSR AEO Agent WordPress plugin to version 3.8.0 or later.