CVE-2026-66664: WordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.

Affected Software

1 affected component

Squirrly SEO<=14.2.0

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress SEO Plugin by Squirrly SEO to a version that resolves this vulnerability.
Fixed in 14.2.1
Compensating control
Until the Squirrly SEO WordPress plugin is updated past 14.2.0, restrict access to the WordPress site (especially any pages/posts where the plugin outputs content) to reduce the likelihood of exploiting the unauthenticated XSS.

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-66664 is rated high with a score of 7.1.

To fix CVE-2026-66664, update the Squirrly SEO plugin to version 14.2.1 or later.

CVE-2026-66664 is an unauthenticated Cross Site Scripting (XSS) vulnerability.

CVE-2026-66664 can allow attackers to execute scripts in the context of an affected website, potentially leading to data theft or manipulation.

Users of the Squirrly SEO plugin versions 14.2.0 and earlier are affected by CVE-2026-66664.