CVE-2026-120552 in SEO Engine Plugin
Summary
by MITRE • 11/03/2026
The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The SEO Engine – Smart SEO with AI, Schema & Redirection plugin for WordPress contains a critical security vulnerability classified as Stored Cross-Site Scripting within versions up to and including 0.9.9. This flaw stems from insufficient input sanitization and output escaping mechanisms when handling the title parameter of posts or pages managed by the plugin. The vulnerability allows authenticated attackers possessing contributor-level access or higher privileges to inject arbitrary web scripts into content that is subsequently stored in the database. Unlike reflected XSS attacks where malicious code executes immediately upon request, this stored variant persists on the server side, meaning the payload will execute whenever any user accesses a page containing the injected script. This persistence significantly increases the attack surface and potential impact, as it can affect not only the attacker but also other users with varying levels of access who view the compromised content.
The technical root cause lies in how WordPress core handles input filtering for specific roles. Specifically, the wp_filter_kses function is applied via the title_save_pre hook when saving titles from Contributors and Authors. While this filter effectively strips literal HTML tag markup during the save process to prevent immediate script execution at that stage, it fails to neutralize HTML-entity-encoded payloads. Consequently, if an attacker submits a payload using entity encoding through standard WordPress interfaces or APIs, such as the POST /wp-json/wp/v2/posts endpoint, the encoded string is stored in the database without being decoded and stripped of its malicious intent. When this data is later rendered by the vulnerable sink within the SEO Engine plugin, the browser interprets the HTML entities as executable code, leading to successful script execution. This bypass demonstrates a classic failure in defense-in-depth strategies where input validation does not account for encoding variations that might evade basic sanitization routines.
From an operational perspective, this vulnerability poses severe risks including session hijacking, credential theft, defacement of website content, and potentially the installation of malware on visitor devices if combined with other vectors like drive-by downloads. Attackers can leverage stored XSS to steal administrative cookies or tokens, thereby escalating their privileges from contributor-level access to full administrator control over the WordPress instance. Furthermore, because SEO plugins often interact heavily with public-facing pages for search engine optimization purposes, these compromised pages are likely to be indexed and visited frequently by a broad audience, amplifying the blast radius of any successful exploitation attempt. The presence of such vulnerabilities in widely used plugins highlights the importance of rigorous code auditing practices that consider not just raw input but also encoded variants and API-specific behaviors.
To mitigate this vulnerability, immediate action is required for all sites running affected versions of the SEO Engine plugin. Administrators should update to version 1.0.0 or later where these issues have been addressed through improved sanitization logic that properly decodes HTML entities before processing them against security filters. In environments where updating is not immediately feasible, temporary mitigations include restricting contributor-level access to trusted individuals only and implementing a Web Application Firewall capable of detecting and blocking entity-encoded XSS payloads in POST requests targeting the WordPress REST API. Additionally, enabling Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected malicious code even if it manages to bypass input filters.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically relates to stored variants under CWE-80. In terms of tactical classification within the MITRE ATT&CK framework, this exploit maps to T1059 Command and Control via Application Layer Protocol for initial access if used in conjunction with other techniques or more directly to T1189 Drive-by Compromise if it leads to malware delivery, though primarily it represents a persistence mechanism through stored malicious content. Security teams should prioritize patching this issue given its potential for privilege escalation and widespread impact on site integrity and user safety. Regular security assessments and adherence to secure coding standards that mandate strict output encoding regardless of input validation outcomes are essential preventive measures against such flaws in future development cycles.