CVE-2026-11588

The CVE concerns the EONSR AEO Agent WordPress plugin, version up to 3.7.9, where an unauthenticated REST API route bypasses authorisation and disables HTML sanitisation before saving posts. This enables stored XSS by creatingadministrator-attributed published posts containing arbitrary scripts, ...