CVE-2026-101357 in SEOPress Plugin
Summary
by MITRE • 10/03/2026
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have delegated the Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The SEOPress WordPress plugin, widely utilized for on-site search engine optimization and analytics integration, contains a critical security flaw identified as Stored Cross-Site Scripting within versions up to 10.2. This vulnerability stems from insufficient input sanitization and output escaping mechanisms applied specifically to the seoppress_google_analytics_matomo_id parameter. The core technical issue lies in the failure of the application to properly validate or encode user-supplied data before storing it in the database and subsequently rendering it on web pages without appropriate encoding. Consequently, when an attacker successfully injects malicious JavaScript payloads into this field, the code is persisted within the site's backend configuration rather than being executed immediately during input submission. This persistence mechanism defines the vulnerability as stored or persistent XSS, distinguishing it from reflected variants where payload execution depends solely on a single request interaction.
The operational impact of this flaw allows authenticated attackers with subscriber-level access and above to execute arbitrary web scripts in the context of any user who views pages containing the compromised analytics configuration data. The severity of this attack vector is significantly amplified by the specific privilege escalation requirement inherent to the plugin's design. By default, WordPress restricts high-level administrative capabilities such as managing Google Analytics or Matomo integration settings to administrators only. However, SEOPress includes an Advanced Security setting that allows site owners to delegate these analytics management permissions to lower-privileged roles like Subscribers. When this delegation is enabled, attackers with minimal initial access can exploit the vulnerability without needing full administrator credentials. This lowers the barrier for entry considerably, as compromising a subscriber account becomes sufficient to initiate the attack chain against higher-privilege users or even the site owner themselves if they view the affected pages.
From an industry standards perspective, this vulnerability maps directly to CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing malicious scripts for later execution aligns with CWE-80 Persistent Cross-Site Scripting. In terms of the MITRE ATT&CK framework, this attack vector corresponds to T1059 Command and Control via Application Layer Protocol or more specifically T1189 Drive-by Client Side Code Injection if targeting end-users browsing the site. The exploitation relies on social engineering tactics where an attacker might trick a high-privilege user into visiting a specific page that triggers the execution of the stored script, facilitating session hijacking, credential theft, defacement, or further malware distribution within the WordPress environment.
Mitigation strategies for this vulnerability involve immediate updates to version 10.3 or later of the SEOPress plugin where these input validation and output escaping issues have been addressed by the developers. For organizations unable to update immediately due to compatibility constraints, a critical administrative action is required: review the Advanced Security settings within the plugin configuration. Administrators must ensure that analytics management capabilities are not delegated to roles with lower privileges such as Subscribers or Contributors unless absolutely necessary for operational workflows. Restricting these permissions back to the Administrator role raises the privilege threshold significantly, thereby reducing the attack surface available to potential intruders who may have compromised low-level accounts. Additionally implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious script injections at the network perimeter before they reach the application logic for storage and execution.