SEOPress EUVD-2026-91905

Exploitation requires two specific preconditions: (1) the site must have the 'Track Authors' custom dimension configured in the plugin's Google Analytics 4 or Matomo settings - a non-default analytics configuration, and (2) the attacker must be able to publish public singular content (e.g., create a bbPress forum topic) so their author display name is rendered inside the generated tracking script. The author display name field is the exact injection point, which is neither sanitized on input nor escaped on output. Limiting factors: if 'Track Authors' is not enabled, the payload is never rendered; and the attacker needs an account/capability to publish public content with a controllable display name, so despite the PR:N in the published CVSS vector, real exploitation is gated by content-publishing access plus a specific opt-in plugin setting.

This is a stored XSS (CWE-79) in the SEOPress WordPress plugin rated CVSS 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reported by Wordfence. The CVSS vector claims unauthenticated (PR:N), low-complexity, network exploitation - but this conflicts materially with the description, which states the attacker 'must be able to publish public singular content (e.g., via bbPress forum topics)' and that the 'Track Authors' custom dimension must first be configured in GA4 or Matomo. These are real preconditions: an account capable of publishing content and a non-default analytics configuration, which realistically argue for PR:L and AC:H rather than PR:N/AC:L - verify authentication requirement with vendor. No EPSS score, KEV listing, or confirmed POC was provided in the input, so there is no signal of active or probable exploitation; this is 'no public exploit identified at time of analysis.' The scope-change (S:C) correctly reflects that injected script executes in other site visitors' browsers. Net assessment: a legitimate but conditional vulnerability whose real-world risk is lower than the 7.2 headline suggests because exploitation depends on a specific analytics feature being enabled plus content-publishing access, not a blanket unauthenticated internet-facing attack.

On a SEOPress site that has enabled the 'Track Authors' custom dimension in its Google Analytics 4 or Matomo settings, an attacker who can publish public content (for example by registering and creating a bbPress forum topic) sets their author display name to a malicious script payload. When any visitor loads a public singular page authored by the attacker, the display name is rendered unescaped inside the analytics tracking script and the script executes in the visitor's browser. No public exploit code was identified in the provided data.