CVE-2026-96564: SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

Q: Which installations are exposed to this issue?

Installations running SEOPress version 10.2 or earlier are affected only when the Track Authors custom dimension is configured in either the plugin's Google Analytics 4 or Matomo settings. The vulnerable author display name must also be rendered in the tracking script on public singular content.

Q: What does an attacker need to exploit it?

An attacker does not need authentication, but must be able to publish public singular content, such as a bbPress forum topic. They must be able to supply an author display name containing script content that is later rendered by the configured tracking feature.

Q: Are default plugin configurations affected?

The issue requires the Track Authors custom dimension to be configured for Google Analytics 4 or Matomo. The provided information does not establish that this setting is enabled by default.

Q: How can I assess whether exploitation may already have occurred?

Review public singular content that can be published by untrusted users, including bbPress topics, and inspect associated author display names for injected script content. Prioritize sites where Track Authors is configured in SEOPress Google Analytics 4 or Matomo settings.

Published Oct 3, 2026

Updated

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in the plugin's Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content (e.g., via bbPress forum topics) so that the injected display name is rendered in the tracking script.

Affected Software

1 affected component

SEOPress SEOPress – AI SEO Plugin & On-site SEO<=10.2

Event History

Oct 3, 2026

CVE Published

via MITRE·05:29 AM

Data Sourced

via MITRE·05:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed to this issue?

Installations running SEOPress version 10.2 or earlier are affected only when the Track Authors custom dimension is configured in either the plugin's Google Analytics 4 or Matomo settings. The vulnerable author display name must also be rendered in the tracking script on public singular content.

What does an attacker need to exploit it?

An attacker does not need authentication, but must be able to publish public singular content, such as a bbPress forum topic. They must be able to supply an author display name containing script content that is later rendered by the configured tracking feature.

Are default plugin configurations affected?

The issue requires the Track Authors custom dimension to be configured for Google Analytics 4 or Matomo. The provided information does not establish that this setting is enabled by default.

How can I assess whether exploitation may already have occurred?

Review public singular content that can be published by untrusted users, including bbPress topics, and inspect associated author display names for injected script content. Prioritize sites where Track Authors is configured in SEOPress Google Analytics 4 or Matomo settings.

CVE-2026-96564: SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

Affected Software

Event History

Frequently Asked Questions

Which installations are exposed to this issue?

What does an attacker need to exploit it?

Are default plugin configurations affected?

How can I assess whether exploitation may already have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed to this issue?

What does an attacker need to exploit it?

Are default plugin configurations affected?

How can I assess whether exploitation may already have occurred?