SEO Engine EUVD-2026-115662

Requires an authenticated WordPress account with contributor-level privileges or above (CVSS PR:L). The attacker must submit an HTML-entity-encoded XSS payload in the 'title' parameter through the standard WordPress REST API (POST /wp-json/wp/v2/posts); literal tag markup is stripped by wp_filter_kses (via title_save_pre for Contributors and Authors), so only entity-encoded payloads survive to the vulnerable SEO Engine sink. Affects all versions up to and including 0.9.9. Limiting factors: the attacker needs a pre-existing content-authoring role, and the payload only fires when a victim subsequently views the injected page - exploitation is not fully unauthenticated and not self-triggering.

This is a stored XSS (CWE-79) scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The signals are internally consistent but point to a moderate, not emergency, priority. Attack vector is network (REST API reachable) with low complexity, but PR:L means exploitation requires a valid authenticated account at contributor level or above, which meaningfully narrows the attacker population to users already granted content-authoring roles. There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation; status is no public exploit identified at time of analysis. The vuln.today Decision label is 'this_month', aligning with a patch-on-normal-cycle posture rather than act_now/emergency. The scope change (S:C) and C:L/I:L reflect that injected script executes in the browser context of any user viewing the poisoned page - including potentially higher-privileged admins - which is the main reason this is worth remediating rather than ignoring. Net: a legitimate but bounded priority, gated by the contributor-authentication requirement; not a high-CVSS-but-illusory issue, but not a drop-everything flaw either.

An attacker who holds (or phishes/registers into) a contributor- or author-level account submits a post via the standard WordPress REST API (POST /wp-json/wp/v2/posts) whose 'title' contains an HTML-entity-encoded script payload. WordPress core's wp_filter_kses strips literal tag markup on save but leaves the entity-encoded payload intact in the database, so when the SEO Engine plugin later outputs the title at its vulnerable sink the script executes in the browser of anyone - including an administrator - who views the page. No public exploit code was identified; the Wordfence references point to source lines and the advisory, not to a verified working exploit.