CVE-2026-108041: SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.
Event History
Frequently Asked Questions
Which sites and users are exposed?
Sites using SEOPress versions before 10.4 are affected if a user has been granted the relevant SEOPress capability. An administrator can delegate that capability to lower-privileged WordPress roles, and injected script can execute for any front-end visitor, including logged-in administrators.
What does an attacker need to exploit this issue?
The attacker needs an account with a SEOPress capability that permits modifying the affected analytics tracking settings. Exploitation also requires a victim to load a front-end page where the stored payload is output.
Are default lower-privileged WordPress accounts necessarily able to exploit it?
No. The affected capability is one that an administrator can delegate to lower-privileged roles; the provided information does not state that those roles receive it by default.
What can be done while a patch cannot be applied?
Review and restrict SEOPress capabilities, especially for lower-privileged roles, so untrusted users cannot modify analytics tracking settings. Review those settings for unexpected or untrusted script content.