SEOPress: Stored XSS through author tracking dimensions
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in the plugin's Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content (e.g., via bbPress forum topics) so that the injected display name is rendered in the tracking script. The export calls the issue unauthenticated but also requires attacker-controlled author metadata and the ability to publish public singular content. It does not establish a universal minimum WordPress role; those publication and tracking-configuration prerequisites must both hold.
- Component
- SEOPress – AI SEO Plugin & On-site SEO
- Plugin slug
wp-seopress- Affected
- <= 10.2
- Safe version
10.3- Published
- Oct 03, 2026
This CVE was published Oct 03, 2026 and is one of 8 known issues for this plugin.
Update, patch or deactivate.
The official author release notes confirm remediation by 10.3; this does not establish that every intervening release was affected. Update the affected edition to 10.3 or a later maintained release on its supported branch. Disable the affected feature or component until the update is installed. An application-level fix should escape display names for the JavaScript output context in tracking scripts. Disable the Track Authors dimension until the update is installed. Official author release notes: https://wordpress.org/plugins/wp-seopress/.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in the plugin's Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content (e.g., via bbPress forum topics) so that the injected display name is rendered in the tracking script.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N