SEOPress EUVD-2026-91912

Exploitation requires an authenticated account with subscriber-level access or above AND a non-default prerequisite: an administrator must have explicitly delegated the Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings. Without that delegation, subscribers cannot reach the vulnerable 'seopress_google_analytics_matomo_id' setting and the flaw is not exploitable. The injected payload only triggers when a user subsequently views a page that renders the stored Matomo ID, so impact depends on a victim (ideally a higher-privileged user) visiting an affected page; this user-visit dependency plus the opt-in configuration are the primary factors limiting real-world exploitation.

This is a low-to-moderate priority issue despite being a stored XSS in a widely-installed plugin, and the CVSS base score of 4.9 (Medium) accurately reflects that. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N shows network reach with low attacker privileges (subscriber), but the High attack complexity (AC:H) is the decisive mitigating signal - it encodes the requirement that an administrator must first opt in to a non-default configuration (delegating the Analytics management capability to the Subscriber role). No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis'. The scope-change flag (S:C) correctly reflects that injected script executes against other users (including administrators) browsing an affected page, which is the main reason this is not purely self-XSS. No signals conflict; all data points consistently to a real but conditionally-exploitable, configuration-dependent flaw rather than an urgent, broadly-exploitable one. The dependency on an opt-in capability delegation means real-world exposure is likely limited to a small subset of SEOPress installations.

On a site where the administrator has used SEOPress's Advanced > Security settings to grant the Analytics management capability to the Subscriber role, a low-privileged subscriber submits a malicious script payload through the 'seopress_google_analytics_matomo_id' field. The payload is stored without proper sanitization and later executes in the browser of any user who views a page rendering that setting, potentially including an administrator, enabling session or account compromise. No public exploit code is referenced, and the High attack complexity reflects the required non-default capability delegation.