---
id: "CVE-2026-120552"
kind: "vulnerability"
aliases: ["CVE-2026-120552"]
title: "SEO Engine WordPress plugin: stored XSS via post title parameter"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "seo-engine", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-contributor-accounts", "plugin-not-installed", "plugin-updated"]
published_at: "2026-11-03T05:18:32+00:00"
first_seen_at: "2026-11-03T05:48:53+00:00"
updated_at: "2026-11-03T05:49:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120552", "first_seen_at": "2026-11-03T05:48:53+00:00"}]
---

# SEO Engine WordPress plugin: stored XSS via post title parameter

The SEO Engine WordPress plugin up to and including 0.9.9 fails to sanitize the title parameter, so output is not escaped. An authenticated contributor can store a script in a page title that runs in the browser of anyone who opens that page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the SEO Engine plugin in the WordPress admin plugins list or `wp plugin get <plugin-slug> --field=version`
- Confirm whether the plugin is active on the site
- Review which accounts hold Contributor or higher roles

## Fix

- Update the SEO Engine plugin to a version later than `0.9.9`; the exact fixed version is unknown from the sources

## Timeline

- 2026-11-03T05:48:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120552

## From the sources

The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_