{"id":"CVE-2026-120552","kind":"vulnerability","aliases":["CVE-2026-120552"],"related":[],"title":"SEO Engine WordPress plugin: stored XSS via post title parameter","description":"The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.","summary":"The SEO Engine WordPress plugin up to and including 0.9.9 fails to sanitize the title parameter, so output is not escaped. An authenticated contributor can store a script in a page title that runs in the browser of anyone who opens that page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","seo-engine","wordpress","wordpress-plugin"],"not_affected_if":["no-contributor-accounts","plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed version of the SEO Engine plugin in the WordPress admin plugins list or `wp plugin get <plugin-slug> --field=version`\n- Confirm whether the plugin is active on the site\n- Review which accounts hold Contributor or higher roles","fix":"- Update the SEO Engine plugin to a version later than `0.9.9`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-03T05:18:32+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:49:54+00:00","updated_at":"2026-11-03T05:49:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T05:49:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the SEO Engine plugin to a version later than `0.9.9`; the exact fixed version is unknown from the sources","reach":"network","title":"SEO Engine WordPress plugin: stored XSS via post title parameter","impact":"medium","summary":"The SEO Engine WordPress plugin up to and including 0.9.9 fails to sanitize the title parameter, so output is not escaped. An authenticated contributor can store a script in a page title that runs in the browser of anyone who opens that page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","seo-engine"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs scripts in visitors' browsers and steals admin sessions","analyst_note":"","how_to_check":"- Check the installed version of the SEO Engine plugin in the WordPress admin plugins list or `wp plugin get <plugin-slug> --field=version`\n- Confirm whether the plugin is active on the site\n- Review which accounts hold Contributor or higher roles","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-updated","no-contributor-accounts"],"who_is_affected":"Sites running the SEO Engine plugin at version 0.9.9 or earlier are exposed. Exploitation requires a logged-in account with Contributor role or higher that can create or edit posts, so sites with only trusted editors or no multi-user publishing are at lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4329,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120552':13A,16A '-2026':12A,15A '/wp-json/wp/v2/posts':187C '0.9.9':34B,101C 'access':121C,137C 'ai':74C 'anyon':63B 'api':185C 'appli':147C 'arbitrari':126C 'attack':116C 'authent':47B,115C 'author':155C 'browser':61B 'contributor':48B,119C,153C 'contributor-level':118C 'core':142C 'cross':87C 'cross-sit':86C 'cve':11A,14A 'databas':172C 'due':102C 'encod':167C,176C 'engin':2A,20B,27B,70C 'entiti':166C,175C 'entity-encod':174C 'escap':45B,109C 'execut':133C 'fail':35B 'filter':145C 'html':165C 'html-entity-encod':164C 'includ':33B,100C 'inject':125C,139C 'input':105C 'insuffici':104C 'intact':169C 'kses':146C 'leav':163C 'level':120C 'liter':157C 'make':111C 'markup':159C 'mean':173C 'neutral':190C 'open':65B 'output':42B,108C 'packag':17B 'page':55B,67B,130C,140C 'paramet':10A,40B,93C 'payload':168C,178C 'plugin':4A,24B,29B,79C 'possibl':113C 'post':8A,186C 'pre':151C 'reach':192C 'redirect':76C 'rest':184C 'run':58B 'sanit':37B,106C 'save':150C,161C 'schema':75C 'script':52B,89C,128C 'seo':1A,19B,26B,69C,72C 'seo-engin':18B 'sink':195C 'site':88C 'smart':71C 'standard':182C 'store':5A,50B,85C,179C 'strip':156C 'tag':158C 'titl':9A,39B,56B,92C,149C 'user':136C 'version':96C 'via':7A,90C,148C,180C 'vulner':83C,194C 'web':127C 'whenev':134C 'wordpress':3A,21B,23B,28B,78C,81C,141C,183C 'wordpress-plugin':22B 'wp':144C 'xss':6A,177C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SEO Engine plugin at version 0.9.9 or earlier are exposed. Exploitation requires a logged-in account with Contributor role or higher that can create or edit posts, so sites with only trusted editors or no multi-user publishing are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","seoengine","wordpress","wordpressplugin"],"first_public_at":"2026-11-03T05:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120552","severity":null,"published_at":"2026-11-03T05:18:32+00:00","modified_at":"2026-11-03T05:18:32+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}