Read the docs
TI-2026-84948 Aliases CVE-2026-108041GHSA-pp67-6fqf-q73f

Stored cross-site scripting in SEOPress analytics tracking settings

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before printing them in an inline script on every front-end page. An authenticated user holding a capability that an administrator can delegate to lower-privileged roles can store script that runs in the browser of any site visitor, including a logged-in administrator viewing the front end (CWE-79). The source description and the CVSS vector indicate a user with low privileges and user interaction is needed, and the flaw can affect confidentiality, integrity and availability. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00294 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed SEOPress (Unknown): 10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSEOPressbefore 10.410.4Patch availableCNA
  • SEOPress VendorUnknown Affected before 10.4 Fixed in 10.4 Patch available CNA

Remediation

Update SEOPress to version 10.4 or later, which fixes the flaw. The sources list no fixed version for SEOPress other than 10.4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA SEOPress (Unknown) Fixed in 10.4

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-108041
  2. 2026-11-04 Alias added: GHSA-pp67-6fqf-q73f
  3. 2026-11-04 CVSS score added · CISA ADP
  4. 2026-11-04 Weakness changed · CISA ADP
  5. 2026-11-04 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences