EUVD-2026-70263
GHSA-74xq-2f66-pchm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS executes in a different privileged user's session (S:C, scope change); Contributor auth required (PR:L); victim must open post (UI:R); no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.
AnalysisAI
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the onload event attribute on iframe elements, bypassing WordPress's built-in content sanitization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Contributor-level (or higher) WordPress account on the target site - unauthenticated exploitation is not possible per the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) accurately captures the constrained exploitation prerequisites - Contributor-level authentication (PR:L) and passive victim interaction (UI:P) - but understates business impact in privileged-access scenarios: a payload executing in an Administrator's session can harvest session tokens, silently create rogue admin accounts, or install malicious plugins, all consistent with the 'Privilege Escalation' tag attached to this CVE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No patched version has been confirmed in any available reference as of this analysis; the VulnCheck advisory (https://www.vulncheck.com/advisories/seowriting-wordpress-plugin-stored-xss-via-iframe-onload) and the WordPress plugin page (https://wordpress.org/plugins/seowriting/) should be monitored for a security release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today