EUVD-2026-53728
GHSA-r9hf-x848-v6cc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:N and PR:N confirmed by unauthenticated REST API access; UI:R because victim must render the post; S:C for browser-context scope change; C:L/I:L for script-level session and page impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts that execute in the browser of any visitor, including administrators (Stored XSS).
AnalysisAI
Stored XSS with privilege bypass in the EONSR AEO Agent WordPress plugin (versions through 3.7.9) allows unauthenticated remote attackers to inject persistent arbitrary JavaScript into published posts, attributed to administrators, that executes in the browser of any site visitor including administrators. The REST API route responsible for post creation performs no authorization check and explicitly disables HTML sanitization before saving content, making this a trivially exploitable unauthenticated write-then-persist attack chain. A publicly available exploit has been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Technical ContextAI
EONSR AEO Agent is a WordPress plugin (CPE: cpe:2.3:a:unknown:eonsr_aeo_agent:*:*:*:*:*:*:*:*) that exposes at least one custom WordPress REST API endpoint. The root cause is a dual failure: missing capability checks (no call to current_user_can() or equivalent on the route handler) and deliberate removal of WordPress's built-in kses HTML sanitization prior to wp_insert_post() or equivalent persistence calls. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) captures the output-side failure, though the missing authorization is an equally critical co-factor. WordPress REST API routes are publicly reachable by default unless explicitly restricted, meaning any unauthenticated HTTP client can reach this endpoint. The resulting stored payload executes in victims' browsers under the origin of the WordPress site, enabling session hijacking, credential phishing, defacement, or admin-level actions via CSRF.
RemediationAI
No patched version has been confirmed in the available intelligence - the WPScan advisory (https://wpscan.com/vulnerability/31381157-63d6-4c26-bd52-2039a2e1a804/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-11588) should be monitored for patch availability. Until a fix is released, the primary compensating control is to deactivate and remove the EONSR AEO Agent plugin entirely; this eliminates the vulnerable REST API route from the attack surface with no functional trade-off for sites that can tolerate losing the plugin's features. If the plugin's functionality is business-critical, restrict access to WordPress REST API endpoints at the web server or WAF layer by blocking unauthenticated POST requests to /wp-json/ routes associated with this plugin - note this may break legitimate plugin behavior. Additionally, deploy a WAF rule to detect and block script tag injection in REST API POST bodies as a detection-in-depth measure. Monitor published posts for unexpected content or administrator-attributed posts not created by known users.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today