CVE-2026-11588: EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation
The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts that execute in the browser of any visitor, including administrators (Stored XSS).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EONSR AEO Agent (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.7.9Patch Unauthenticated Stored XSS via Scheduled Post Creation - Configuration
Ensure the affected REST API route performs proper authorization checks instead of allowing unauthenticated access.
EONSR AEO Agent (WordPress plugin) REST API route authorization check = required - Configuration
Re-enable HTML sanitisation before saving posts, rather than disabling sanitisation during scheduled post creation.
EONSR AEO Agent (WordPress plugin) HTML sanitisation before saving posts = enabled - Compensating control
Apply compensating browser-side protections until the plugin is fixed to reduce impact of Stored XSS (e.g., enforce a restrictive Content Security Policy and ensure admin sessions are not overly exposed).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11588?
CVE-2026-11588 has a risk score of 71, indicating it is a serious vulnerability.
What type of vulnerability is CVE-2026-11588?
CVE-2026-11588 is an Unauthenticated Stored XSS vulnerability affecting versions of the EONSR AEO Agent WordPress plugin up to 3.7.9.
How do I fix CVE-2026-11588?
To mitigate CVE-2026-11588, update the EONSR AEO Agent WordPress plugin to the latest version where the vulnerability is patched.
Who can be affected by CVE-2026-11588?
CVE-2026-11588 can affect any WordPress site using the EONSR AEO Agent plugin versions up to 3.7.9 that lacks proper authentication and sanitization.
What impact does CVE-2026-11588 have on a website?
CVE-2026-11588 allows unauthenticated attackers to publish posts with malicious scripts that can compromise the website and its users.