What is the CVSS score of CVE-2026-66664?

CVE-2026-66664 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Squirrly SEO are affected by CVE-2026-66664?

Squirrly SEO WordPress plugin through version 14.2.0 contains a reflected cross-site scripting vulnerability allowing unauthenticated attackers to compromise WordPress administrator sessions and…

How to fix or mitigate CVE-2026-66664?

Within 24 hours, audit all WordPress deployments for Squirrly SEO plugin presence and identify systems running versions through 14.2.0. Within 7 days, disable the Squirrly SEO plugin on all affected WordPress instances and notify users; implement Web Application Firewall rules to filter reflected XSS payloads targeting the plugin endpoints if disablement is not immediately feasible; contact Squirrly directly to confirm patch availability status. Within 30 days, evaluate and deploy an alternative SEO plugin, establish vulnerability monitoring workflows, and document lessons learned from this gap in patch availability.

Squirrly SEO CVE-2026-66664

EUVD-2026-53890 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-8x3x-hpv5-fj9r

WordPress XSS Seo Plugin By Squirrly Seo Wordpress Plugin Seo Squirrly

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS with no auth required and scope change warrants PR:N and S:C; A:N because XSS does not credibly cause availability impact independently.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:41 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.

AnalysisAI

Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.

Technical ContextAI

The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS, meaning user-supplied input - likely via a URL query parameter processed by the plugin - is echoed into the HTML response without adequate sanitization or output encoding. The affected product is identified by CPE cpe:2.3:a:seo_squirrly:seo_plugin_by_squirrly_seo:*:*:*:*:*:*:*:* and operates as a WordPress plugin, meaning it runs within the WordPress PHP application context and has access to authentication cookies, session data, and DOM content of the hosting site. The scope change (S:C) in the CVSS vector is characteristic of browser-context XSS: the injected script executes under the victim site's origin, giving it access to cookies, localStorage, and same-origin resources beyond what the plugin itself controls.

RemediationAI

Update the SEO Plugin by Squirrly SEO to a version beyond 14.2.0 as soon as one is published by the vendor; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/squirrly-seo/vulnerability/wordpress-seo-plugin-by-squirrly-seo-plugin-14-1-1-reflected-cross-site-scripting-xss-vulnerability should be monitored for the confirmed patched release version, which was not independently verifiable from available input data. As a compensating control where immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block reflected XSS patterns in query parameters destined for this plugin's endpoints - this reduces but does not eliminate risk and may cause false positives on legitimate SEO-related query strings. Additionally, limiting the exposure of the plugin's affected parameter-handling endpoints via URL filtering at the perimeter, or disabling the specific plugin feature responsible if identifiable, are viable interim measures. WordPress administrators should be educated to treat unsolicited links to their own site with suspicion, as the attack requires social engineering of an authenticated session holder.