CVE-2026-116535: SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag

Q: Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker must be able to change their WordPress display name.

Q: What must an attacker do to trigger the vulnerable behavior?

The attacker sets their display_name to a value containing the literal %%archive_title%% token together with an HTML event-handler payload. The payload executes when another user accesses a page where the injected content is rendered.

Q: Are sites affected by default?

The issue depends on a user-controlled display name being crafted with the %%archive_title%% token and an HTML event-handler payload. It is therefore not triggered merely by installing the plugin, but any site that permits untrusted Subscriber accounts is exposed to this attack path.

Q: How can I check whether exploitation may have occurred?

Review WordPress user display names, especially for Subscriber and higher-privileged accounts, for the literal %%archive_title%% token or unexpected HTML and event-handler attributes. Also inspect pages that render affected archive-title template content for injected script-like markup.

Published Oct 31, 2026

Updated

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber who sets their displayname to a string containing the literal %%archivetitle%% token alongside HTML event-handler payloads, as WordPress stores display names without HTML filtering and the plugin substitutes the token after escaping has already occurred.

Event History

Oct 31, 2026

CVE Published

via MITRE·07:46 AM

Data Sourced

via MITRE·07:46 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker must be able to change their WordPress display name.

What must an attacker do to trigger the vulnerable behavior?

The attacker sets their display_name to a value containing the literal %%archive_title%% token together with an HTML event-handler payload. The payload executes when another user accesses a page where the injected content is rendered.

Are sites affected by default?

The issue depends on a user-controlled display name being crafted with the %%archive_title%% token and an HTML event-handler payload. It is therefore not triggered merely by installing the plugin, but any site that permits untrusted Subscriber accounts is exposed to this attack path.

How can I check whether exploitation may have occurred?

Review WordPress user display names, especially for Subscriber and higher-privileged accounts, for the literal %%archive_title%% token or unexpected HTML and event-handler attributes. Also inspect pages that render affected archive-title template content for injected script-like markup.

CVE-2026-116535: SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag

Event History

Frequently Asked Questions

Who can exploit this issue?

What must an attacker do to trigger the vulnerable behavior?

Are sites affected by default?

How can I check whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What must an attacker do to trigger the vulnerable behavior?

Are sites affected by default?

How can I check whether exploitation may have occurred?