EUVD-2026-63298
GHSA-p233-84cf-8p2x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS requires no privileges and network delivery with scope change; availability impact removed as XSS does not realistically disrupt service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
AnalysisAI
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must successfully deliver a crafted URL or page to a victim who is concurrently authenticated to the WordPress installation running Squirrly SEO plugin version 14.2.2 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 High score is driven by network accessibility with no authentication requirement and a scope change, though the mandatory user interaction (UI:R) gates exploitation on the victim actively engaging with attacker-controlled content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update SEO Plugin by Squirrly SEO to a version above 14.2.2 via the WordPress plugin dashboard or directly from the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all WordPress installations to identify which are running Squirrly SEO plugin version 14.2.2 or earlier, and document the sensitivity level of each affected site. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Seo Plugin By Squirrly Seo
View allStored Cross-Site Scripting in the SEO Plugin by Squirrly SEO for WordPress (versions up to and including 12.3.19) allow
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly SEO Plugi
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SEO Squirrly SEO P
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly
In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Squirrly SEO Plugi
Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated
Missing Authorization vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO.4.05. Rated high severity (CVSS 7.1), thi
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in a
Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.1.20. Rated medium severity (CVSS 6.3), this
Broken access control in SEO Plugin by Squirrly SEO version 12.4.16 and earlier allows unauthenticated remote attackers
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today