CVE-2026-75134: SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue, and who is at risk from the payload?
An authenticated user with the Contributor role can store the malicious content. The payload executes when an affected post is viewed or previewed by a higher-privileged user, placing those users at risk of account compromise or privilege escalation.
Which plugin versions are affected?
The issue affects SEOWriting for WordPress through version 1.12.5. No fixed version is identified in the available information.
What content should be reviewed for signs of exploitation?
Review post content created or edited by contributors for iframe elements carrying an onload event handler. The vulnerability relies on storing JavaScript payloads in post content through iframe onload.