EUVD-2026-98297
GHSA-36xp-86g8-82wm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
DeliveryInject malicious script into SEO field
-
ExploitPayload stored unsanitized in database
-
ExecutionAdmin views affected page
-
PersistScript executes in admin session
-
ImpactHijack privileged actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at least low-privilege access to a plugin-managed input field (PR:L) - not an anonymous remote attacker. The payload is stored, so it does not execute until a second user, typically a logged-in administrator, loads the affected plugin or content page (UI:R), making privileged victim interaction a hard prerequisite. Limiting factors: the attacker must first obtain a valid account on the target site, the targeted victim must have an active authenticated session, and only sites running FV Simpler SEO version 1.9.7 or earlier are affected. |
| Impact | This is a moderate-severity Stored XSS (CWE-79) in the FolioVision FV Simpler SEO WordPress plugin, scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by Patchstack. The network vector with low complexity is offset by two meaningful dampeners: PR:L requires the attacker to already hold an authenticated low-privilege account, and UI:R means a victim (typically an administrator) must view the injected page before the payload fires. No EPSS score was provided in the input, there is no CISA KEV listing, and no public POC is identified, so all three of the strongest real-world exploitation signals are absent. The scope change (S:C) is the one elevating factor - stored script executing in an admin's authenticated session can pivot to higher-privilege actions. On balance this is a real but not urgent issue: a typical low-prevalence authenticated stored XSS in a niche SEO plugin, prioritized for routine patching rather than emergency response. Missing signal note: no EPSS value was supplied, so widespread-exploitation probability could not be quantified and is treated as unknown rather than assumed low. |
| Exploit ScenarioDerived | A low-privileged authenticated WordPress user (e.g., a contributor or author role permitted to edit SEO metadata) submits a crafted payload into a plugin-controlled field that is stored unsanitized. When an administrator later opens the affected plugin or post screen in wp-admin, the stored JavaScript executes in their authenticated session, enabling actions such as account or settings manipulation. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Stored cross-site scripting in the FolioVision FV Simpler SEO WordPress plugin (versions through 1.9.7) lets a user who already holds a low-privilege account on the site persist malicious script into a plugin-managed input field, which then executes in the browser of a higher-privileged user - typically a logged-in administrator - who views the affected plugin or content page. Patchstack scores it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the S:C scope change indicating the injected script can affect resources beyond the vulnerable component; exploitation is gated on two prerequisites, a valid account (PR:L) and interaction by an authenticated victim (UI:R), so it is not an anonymous drive-by attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the plugin is a niche WordPress SEO extension rather than a widely deployed platform component, which limits practical exposure.
RemediationAI
The primary action is to upgrade FV Simpler SEO to a release later than 1.9.7 as soon as one is confirmed available; no exact fix version is documented in the available data, so verify the patched build against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/fv-all-in-one-seo-pack/vulnerability/wordpress-fv-simpler-seo-plugin-1-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve) or the WordPress.org plugin page rather than assuming a version number. Patch status is therefore best described as unconfirmed: no vendor-released patch version is identified at time of analysis, and the absence of patch data is not confirmation that none exists. If no fix can be confirmed, deactivate and remove the plugin - the trade-off is loss of its SEO functionality - but note that uninstalling does not scrub payloads already written to the database, so a post-cleanup audit of posts, comments, and postmeta/options rows for injected script tags is required or the stored XSS will persist and re-trigger. Effective compensating controls follow directly from the PR:L/UI:R prerequisites: disable open user registration and prune dormant low-privilege accounts so an attacker cannot obtain the account the attack depends on (side effect: no self-service signups, manual provisioning overhead); tighten role capabilities so subscribers and similar roles cannot write to plugin-managed fields or unfiltered HTML (side effect: may break legitimate editorial workflows); deploy WAF rules filtering stored-XSS payloads aimed at the plugin's endpoints (side effect: encoding and obfuscation can bypass signatures, and aggressive rules produce false positives on legitimate content); and apply a Content Security Policy that blocks inline and third-party script execution to blunt post-injection execution (side effect: requires careful tuning and can break legitimate plugin and theme scripts). Because exploitation requires an authenticated victim to load the poisoned page, restricting administrative browsing to trusted sessions and monitoring administrator activity for anomalous requests or unexpected content changes also reduces the window between injection and execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, in the WordPress plugin fv-all-in-one-seo-pack published by FolioVision (CPE cpe:2.3:a:foliovision:fv_simpler_seo:*:*:*:*:*:*:*:*). The stored variant means attacker-controlled input is persisted server-side (for example in post meta, plugin options, or a settings field exposed to non-administrative roles) and later emitted into an HTML page without adequate output encoding or sanitization; because the payload is saved rather than reflected, a single injection can fire for every subsequent viewer of the affected page. The CVSS vector is the key to understanding the threat model: PR:L requires the attacker to already possess a low-privilege WordPress account, UI:R requires a second, authenticated user to load the poisoned page before execution occurs, and S:C means the script executes with the privileges of the vulnerable page's origin and can reach beyond the plugin component itself - commonly enabling session-token theft, administrator-account takeover, or injection of further stored content. AC:L and AV:N indicate the attack itself is trivially launched over the network once an account exists, and the Low confidentiality, integrity, and availability sub-scores reflect impact typical of XSS rather than full server compromise. This is a plugin-level defect, so the WordPress core, theme, and other plugins remain unaffected; only sites running FV Simpler SEO 1.9.7 or earlier are in scope.
Know when Fv Simpler Seo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Authenticated low-privilege user stores the payload (PR:L), an admin must render it (UI:R), and script running in the victim's session crosses a security boundary (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB