CVE-2026-124412: WordPress Slim SEO plugin <= 4.11.5 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/slim-seoto a version that resolves this vulnerability.Fixed in 4.11.6
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-privileged access to the affected WordPress site. It does not require user interaction, and it can be exploited over the network.
What versions are affected?
Slim SEO versions through 4.11.5 are affected. The available information does not identify a fixed version.
What is the potential impact?
Successful exploitation can allow content injection through basic cross-site scripting. The reported impact is limited to confidentiality, with no integrity or availability impact indicated.