CVE-2026-120552 SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()

The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-120552

The SEO Engine – Smart SEO with AI, Schema & Redirection WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 0.9.9 . The root cause is insufficient input sanitization and output escaping within the 'title' parameter . Specifically, while WordPre...