---
id: "CVE-2026-108041"
kind: "vulnerability"
aliases: ["CVE-2026-108041"]
title: "SEOPress WordPress plugin: stored script injection reaches every site visitor"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "seopress", "wordpress"]
not_affected_if: ["no-delegated-seopress-roles", "seopress-absent", "version-10.4-or-later"]
published_at: "2026-11-04T06:16:57+00:00"
first_seen_at: "2026-11-04T06:25:17+00:00"
updated_at: "2026-11-04T06:26:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108041", "first_seen_at": "2026-11-04T06:25:17+00:00"}]
---

# SEOPress WordPress plugin: stored script injection reaches every site visitor

The SEOPress WordPress plugin before 10.4 fails to clean analytics tracking settings before printing them into a script on every front-end page. A user who holds a delegated SEOPress capability can store script that runs in the browser of any visitor, including a logged-in administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SEOPress version in the WordPress admin plugins list or with `wp plugin get wp-seopress --field=version` if WP-CLI is available.
- Review the analytics tracking settings in SEOPress for unexpected script content.

## Fix

- SEOPress: `10.4` or later, per the advisory's stated fixed version.

## Timeline

- 2026-11-04T06:25:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108041

## From the sources

The SEOPress  WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress  WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_