4 matches found
WordPress EONSR AEO Agent plugin <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation vulnerability
Unauthenticated Stored XSS via Scheduled Post Creation vulnerability discovered by Pedro Pinho in WordPress Plugin EONSR AEO Agent versions = 3.7.9...
CVE-2026-11588 EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation
The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...
CVE-2026-11588 EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation
The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...
