4 matches found
CVE-2026-108041
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate t...
EUVD-2026-116715
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate t...
CVE-2026-108041 SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate t...
CVE-2026-108041
The SEOPress WordPress plugin before version 10.4 is vulnerable to Stored Cross-Site Scripting (XSS) . The issue stems from a failure to properly sanitise and escape certain analytics tracking settings before they are output as an inline script on every front-end page. This allows users with spec...