SEOPress EUVD-2026-114650

Requires an authenticated account at Subscriber level or above (PR:L) on the target WordPress site - self-registration, where enabled, makes this trivial. The attacker sets their profile display_name to a string containing the literal %%archive_title%% token alongside an HTML event-handler payload; WordPress stores display names without HTML filtering and SEOPress substitutes the token after output escaping has already occurred, defeating the escaping. Exploitation further depends on the site configuration actually rendering the %%archive_title%% dynamic variable on a page where the attacker's display name is surfaced, and on the payload page being accessed by a victim. Limiting factors: Subscriber-level authentication is mandatory (no unauthenticated path), and the specific token/variable rendering condition must be met; affects all versions up to and including 10.3.

This is a moderate-priority stored XSS (CWE-79) with a balanced, not alarmist, risk profile. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) indicates a network-reachable, low-complexity flaw that requires authentication (PR:L - Subscriber-level) and no attacker-driven user interaction, with a changed scope reflecting that injected script executes in other users' browser context. No EPSS score was provided, so statistical exploitation probability cannot be stated. KEV status is not listed, so this is not confirmed as actively exploited. No PoC or working-exploit reference appears in the input (the references are a Wordfence advisory, WordPress trac source lines, and the fix changeset) - so no public exploit is identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a real but non-emergency issue: a genuine stored XSS requiring a (trivially obtainable) Subscriber account, warranting scheduled patching rather than crisis response. The signals are internally consistent - there is no conflict between CVSS network vector and the description, which confirms remote, authenticated (Subscriber) exploitation. The main limiting factor is the authentication requirement plus the specific condition that the site must render the %%archive_title%% token where the display name is substituted.

A low-privileged Subscriber registers or already holds an account and sets their WordPress display name to a value containing the literal %%archive_title%% token combined with an HTML event-handler payload; WordPress stores the display name without HTML filtering. When a visitor or administrator loads a page where SEOPress substitutes the %%archive_title%% dynamic variable after output escaping has already run, the payload executes in that user's browser. No public exploit code is identified at time of analysis, though the mechanism is described in detail in the Wordfence advisory and the patched source.