{"id":"CVE-2026-125450","kind":"vulnerability","aliases":["CVE-2026-125450"],"related":[],"title":"SureRank WordPress plugin: stored XSS through version 1.10.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank allows Stored XSS.This issue affects SureRank: from n/a through 1.10.3.","summary":"SureRank, an SEO plugin for WordPress by Brainstorm Force, has a stored cross-site scripting flaw. Injected script runs in the browser of anyone who views the affected page, which can lead to session or account takeover.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","surerank","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed SureRank plugin version in the WordPress admin under Plugins; versions through `1.10.3` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","triaged_at":"2026-11-11T13:29:17+00:00","updated_at":"2026-11-11T13:29:17+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SureRank WordPress plugin: stored XSS through version 1.10.3","impact":"medium","summary":"SureRank, an SEO plugin for WordPress by Brainstorm Force, has a stored cross-site scripting flaw. Injected script runs in the browser of anyone who views the affected page, which can lead to session or account takeover.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","surerank"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, stealing sessions","analyst_note":"Confirm the fixed version and the required privilege for the stored XSS from the Brainstorm Force SureRank advisory or the WordPress plugin changelog.","how_to_check":"- Check the installed SureRank plugin version in the WordPress admin under Plugins; versions through `1.10.3` are listed as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SureRank plugin at version 1.10.3 or earlier are listed as affected in the NVD description. The sources do not state which roles can store the malicious input, so unknown whether an account is needed. Sites without SureRank installed are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4543,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125450':11A,14A '-2026':10A,13A '1.10.3':8A,83C 'account':54B 'affect':46B,78C 'allow':74C 'anyon':42B 'brainstorm':25B,70C 'browser':40B 'cross':31B,65C 'cross-sit':30B,64C 'cve':9A,12A 'flaw':34B 'forc':26B,71C 'generat':63C 'improp':56C 'inject':35B 'input':59C 'issu':77C 'lead':50B 'n/a':81C 'neutral':57C 'packag':15B 'page':47B,62C 'plugin':3A,21B 'run':37B 'script':33B,36B,67C 'seo':20B 'session':52B 'site':32B,66C 'store':4A,29B,75C 'surerank':1A,16B,18B,72C,73C,79C 'takeov':55B 'version':7A 'view':44B 'vulner':68C 'web':61C 'wordpress':2A,17B,23B 'xss':5A 'xss.this':76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureRank plugin at version 1.10.3 or earlier are listed as affected in the NVD description. The sources do not state which roles can store the malicious input, so unknown whether an account is needed. Sites without SureRank installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","surerank","wordpress"],"campaign_type":null,"search_a":"'-125450':11A,14A '-2026':10A,13A '1.10.3':8A 'cve':9A,12A 'plugin':3A 'store':4A 'surerank':1A 'version':7A 'wordpress':2A 'xss':5A","search_b":"'account':54B 'affect':46B 'anyon':42B 'brainstorm':25B 'browser':40B 'cross':31B 'cross-sit':30B 'flaw':34B 'forc':26B 'inject':35B 'lead':50B 'packag':15B 'page':47B 'plugin':21B 'run':37B 'script':33B,36B 'seo':20B 'session':52B 'site':32B 'store':29B 'surerank':16B,18B 'takeov':55B 'view':44B 'wordpress':17B,23B","search_c":"'1.10.3':83C 'affect':78C 'allow':74C 'brainstorm':70C 'cross':65C 'cross-sit':64C 'forc':71C 'generat':63C 'improp':56C 'input':59C 'issu':77C 'n/a':81C 'neutral':57C 'page':62C 'script':67C 'site':66C 'store':75C 'surerank':72C,73C,79C 'vulner':68C 'web':61C 'xss.this':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125450","severity":null,"published_at":"2026-11-11T13:17:21+00:00","modified_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","fetched_at":"2026-11-11T13:27:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}