Live › vulnerability › CVE-2026-116535
The SEOPress WordPress plugin up to and including version 10.3 fails to escape a user's display name, so a subscriber can store a script that runs in pages other visitors open. An attacker gets script execution in the browser of whoever loads the injected page, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 08:34 UTC. All times on this page are UTC.
Sites running the SEOPress plugin at version 10.3 or older are exposed. The attacker needs a subscriber-level account, so sites that do not allow open registration and do not have subscriber accounts are less exposed. Sites with public registration or many low-privilege users should look at this first.
No product ranges from the sources yet.
seopress in the plugin directory listing on the server10.3; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber who sets their display_name to a string containing the literal %%archive_title%% token alongside HTML event-handler payloads, as WordPress stores display names without HTML filtering and the plugin substitutes the token after escaping has already occurred.
This page as .md · .json · in your agent: get_signal("CVE-2026-116535")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.