WordPress Plugin Vulnerabilities

SEOWriting <= 1.12.5 - Authenticated (Contributor +) Stored Cross-Site Scripting

Description

The SEOWriting plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.12.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
seowriting
No known fix

References

CVE
CVE-2026-75134
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1cd087ec-2cb1-4853-a10f-a1e31089177b

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (Medium)

Miscellaneous

Original Researcher
Aurélien BOURDOIS (Elymaro)
Verified
No
WPVDB ID
23945ac1-e94b-4438-b7e7-eecb3af957da

Timeline

Publicly Published
2026-09-02 (about 1 month ago)
Added
2026-09-16 (about 1 month ago)
Last Updated
2026-09-16 (about 1 month ago)

Other

Published
Title
Published
2022-03-29
Title
Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting
Published
2026-08-18
Title
Table Of Contents Block < 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-26
Title
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty < 3.3.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Published
2026-04-13
Title
ShopLentor < 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
Published
2026-01-26
Title
Gallery PhotoBlocks < 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting