CVE-2026-66614: WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability
Published Aug 20, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
Affected Software
1 affected component
wordpress-seo-plugin-by-squirrly-seo<=14.2.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SEO Plugin by Squirrly SEOto a version that resolves this vulnerability.Fixed in 14.2.3
Event History
Aug 20, 2026
CVE Published
via MITRE·12:07 PM
Data Sourced
via MITRE·12:07 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
No authentication is required. The attack vector is network-accessible, but exploitation requires user interaction.
2
Which plugin versions are affected?
The vulnerability affects SEO Plugin by Squirrly SEO versions 14.2.2 and earlier.
3
What is the potential impact if exploitation succeeds?
Successful XSS can affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the impact can extend beyond the vulnerable plugin's security authority.