{"id":"CVE-2026-124412","kind":"vulnerability","aliases":["CVE-2026-124412"],"related":[],"title":"Slim SEO WordPress plugin: stored XSS via script tags in web pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5.","summary":"Slim SEO by eLightUp has a basic cross-site scripting flaw that lets script tags be injected into web pages. An attacker who can supply that content can run JavaScript in a visitor's browser.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","slim-seo","wordpress"],"not_affected_if":[],"how_to_check":"- Check whether the Slim SEO plugin (slim-seo) is installed and its version, which the sources say is affected through `4.11.5`","fix":null,"status":"open","published_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:50:09+00:00","updated_at":"2026-11-13T15:50:09+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-13T15:50:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Slim SEO WordPress plugin: stored XSS via script tags in web pages","impact":"medium","summary":"Slim SEO by eLightUp has a basic cross-site scripting flaw that lets script tags be injected into web pages. An attacker who can supply that content can run JavaScript in a visitor's browser.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","slim-seo"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers on the affected site","analyst_note":"Confirm the affected product ecosystem, the fixed version and the required privilege from the NVD entry or the vendor's advisory; the sources give no fixed version.","how_to_check":"- Check whether the Slim SEO plugin (slim-seo) is installed and its version, which the sources say is affected through `4.11.5`\n- unknown for other checks","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Slim SEO plugin at version 4.11.5 or earlier are listed as affected. The sources do not say which user role or input is needed to inject the script, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4556,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124412':15A,18A '-2026':14A,17A '4.11.5':92C 'affect':86C 'allow':82C 'attack':46B 'basic':30B,72C 'browser':59B 'code':83C 'content':51B 'cross':32B 'cross-sit':31B 'cve':13A,16A 'elightup':27B,76C 'flaw':35B 'html':66C 'improp':60C 'inject':41B 'injection.this':84C 'issu':85C 'javascript':54B 'let':37B 'n/a':90C 'neutral':61C 'page':12A,44B,71C 'plugin':4A 'relat':65C 'run':53B 'script':8A,34B,38B,64C 'script-rel':63C 'seo':2A,22B,25B,78C,81C,88C 'site':33B 'slim':1A,21B,24B,77C,80C,87C 'slim-seo':20B,79C 'store':5A 'suppli':49B 'tag':9A,39B,67C 'via':7A 'visitor':57B 'vulner':74C 'web':11A,43B,70C 'wordpress':3A,23B 'xss':6A,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Slim SEO plugin at version 4.11.5 or earlier are listed as affected. The sources do not say which user role or input is needed to inject the script, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","slimseo","wordpress"],"campaign_type":null,"search_a":"'-124412':15A,18A '-2026':14A,17A 'cve':13A,16A 'page':12A 'plugin':4A 'script':8A 'seo':2A 'slim':1A 'store':5A 'tag':9A 'via':7A 'web':11A 'wordpress':3A 'xss':6A","search_b":"'attack':46B 'basic':30B 'browser':59B 'content':51B 'cross':32B 'cross-sit':31B 'elightup':27B 'flaw':35B 'inject':41B 'javascript':54B 'let':37B 'page':44B 'run':53B 'script':34B,38B 'seo':22B,25B 'site':33B 'slim':21B,24B 'slim-seo':20B 'suppli':49B 'tag':39B 'visitor':57B 'web':43B 'wordpress':23B","search_c":"'4.11.5':92C 'affect':86C 'allow':82C 'basic':72C 'code':83C 'elightup':76C 'html':66C 'improp':60C 'injection.this':84C 'issu':85C 'n/a':90C 'neutral':61C 'page':71C 'relat':65C 'script':64C 'script-rel':63C 'seo':78C,81C,88C 'slim':77C,80C,87C 'slim-seo':79C 'tag':67C 'vulner':74C 'web':70C 'xss':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124412","severity":null,"published_at":"2026-11-13T15:17:36+00:00","modified_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}