CVE-2026-124412 · Other
NO FIX YET
Slim SEO by eLightUp has a basic cross-site scripting flaw that lets script tags be injected into web pages. An attacker who can supply that content can run JavaScript in a visitor's browser.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Slim SEO plugin at version 4.11.5 or earlier are listed as affected. The sources do not say which user role or input is needed to inject the script, so the exact exposure is unknown.
Who cares slim-seo, wordpress
4.11.5No fix yet, per the sources.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.