CVE-2026-116535 in SEOPress Plugin
Summary
by MITRE • 10/31/2026
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber who sets their display_name to a string containing the literal %%archive_title%% token alongside HTML event-handler payloads, as WordPress stores display names without HTML filtering and the plugin substitutes the token after escaping has already occurred.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The SEOPress AI SEO Plugin for WordPress contains a critical stored cross-site scripting vulnerability affecting all versions up to and including 10.3. This flaw stems from insufficient input sanitization and output escaping mechanisms within the application logic, specifically concerning how user profile data is handled during content generation processes. The vulnerability allows authenticated attackers with subscriber-level access or higher privileges to inject arbitrary web scripts into pages that are subsequently viewed by other users. Because the malicious code is stored in the database via the display_name parameter, it persists and executes automatically whenever a victim accesses any page where this vulnerable token substitution occurs, creating a persistent threat vector rather than a transient session-based attack.
The technical root cause of this vulnerability lies in the specific sequence of operations performed by the plugin when rendering content that includes dynamic user data. WordPress natively stores display names without applying HTML filtering or escaping to prevent basic injection attacks within profile fields. However, SEOPress attempts to enhance these profiles by substituting a placeholder token, specifically %%archive_title%%, with actual archive titles during page generation. The critical failure occurs because the plugin performs this substitution after the standard WordPress output escaping has already been applied. Consequently, any HTML or JavaScript payloads embedded in the display_name field are not escaped before being processed by the plugin's replacement logic. This timing error allows raw script tags and event handlers to survive the sanitization process and be injected directly into the DOM of the rendered page.
Exploitation of this vulnerability requires an attacker with at least subscriber-level access, which is a relatively low privilege level in many WordPress installations. The attack vector involves setting one's display_name field to contain both the literal string %%archive_title%% and malicious HTML event-handler payloads such as onerror or onload attributes containing JavaScript code. When another user views a page that triggers this token substitution, the browser interprets the injected payload as executable script within the context of the site. This leads to session hijacking, credential theft, defacement, or redirection to phishing sites depending on the specific payload delivered by the attacker. The stored nature of the XSS means that every visitor to the affected page becomes a potential victim without needing any further interaction from the attacker after the initial profile modification.
From an industry standard perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically it represents stored XSS where malicious scripts are permanently stored in target servers and executed when users retrieve information from them. In terms of the MITRE ATT&CK framework for enterprise security, this behavior maps to T1059 Command and Control via Application Layer Protocol or more accurately T1189 Drive-by Client Side Scripting if used for initial access through social engineering leading to profile manipulation. It also relates to TA0003 Persistence as the malicious code remains in the database until manually removed, allowing repeated exploitation without additional effort from the adversary.
Mitigation strategies should focus on immediate remediation and long-term defensive coding practices. The most effective solution is for administrators to update the SEOPress plugin to a version where this vulnerability has been patched by ensuring proper escaping occurs before token substitution or applying strict output encoding after all dynamic content replacements are complete. Until an official patch is available, site owners should restrict user registration privileges and manually review existing user profiles for suspicious display names containing script tags or event handlers. Implementing Content Security Policy headers can also help mitigate the impact of successful XSS attacks by restricting the sources from which scripts can be loaded and executed within the browser environment. Developers must ensure that any dynamic content replacement logic respects the order of operations regarding security filters, typically applying escaping last to guarantee all injected data is neutralized before being sent to the client.