CVE-2026-108041 · Package
NO FIX YET · SEE WHAT TO DO
The SEOPress WordPress plugin before 10.4 fails to clean analytics tracking settings before printing them into a script on every front-end page. A user who holds a delegated SEOPress capability can store script that runs in the browser of any visitor, including a logged-in administrator.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the SEOPress WordPress plugin before 10.4 that delegate SEOPress capabilities to lower-privileged roles are exposed. Sites without SEOPress, or with it already at 10.4 or later, can skip this. The attacker needs an account with a delegated SEOPress capability, and the script then runs on front-end pages.
Not affected if no-delegated-seopress-roles, seopress-absent, version-10.4-or-later
Who cares self-hosted, seopress, wordpress
wp plugin get wp-seopress --field=version if WP-CLI is available.10.4 or later, per the advisory's stated fixed version.The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.
This page as .md · .json · in your agent: get_signal("CVE-2026-108041")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.