Seopress Ai Seo Plugin On Site Seo
Monthly
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets an attacker inject arbitrary JavaScript that is rendered unescaped inside the plugin's Google Analytics 4 or Matomo tracking script. Two preconditions gate real exploitation: the non-default 'Track Authors' custom dimension must be configured in the plugin's GA4/Matomo settings, and the attacker must be able to publish public singular content (for example a bbPress forum topic) so their controllable author display name reaches the tracking output. Wordfence reports it as CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and our own independent assessment rates it lower at AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N because the opt-in analytics setting plus content-publishing access make exploitation conditional rather than trivial.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets authenticated attackers with subscriber-level access inject arbitrary web scripts through the 'seopress_google_analytics_matomo_id' setting, which then execute in the browser of any user who views a page rendering the stored Matomo ID. Exploitation is gated by a non-default prerequisite: an administrator must have explicitly delegated Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings, without which subscribers cannot reach the vulnerable setting, and the injected payload only fires when a victim subsequently visits an affected page. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score of 4.9 (Medium) reflects the opt-in configuration and user-visit dependency that limit real-world exploitation.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets an attacker inject arbitrary JavaScript that is rendered unescaped inside the plugin's Google Analytics 4 or Matomo tracking script. Two preconditions gate real exploitation: the non-default 'Track Authors' custom dimension must be configured in the plugin's GA4/Matomo settings, and the attacker must be able to publish public singular content (for example a bbPress forum topic) so their controllable author display name reaches the tracking output. Wordfence reports it as CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and our own independent assessment rates it lower at AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N because the opt-in analytics setting plus content-publishing access make exploitation conditional rather than trivial.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets authenticated attackers with subscriber-level access inject arbitrary web scripts through the 'seopress_google_analytics_matomo_id' setting, which then execute in the browser of any user who views a page rendering the stored Matomo ID. Exploitation is gated by a non-default prerequisite: an administrator must have explicitly delegated Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings, without which subscribers cannot reach the vulnerable setting, and the injected payload only fires when a victim subsequently visits an affected page. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score of 4.9 (Medium) reflects the opt-in configuration and user-visit dependency that limit real-world exploitation.