Stored Cross-Site Scripting in SEOPress WordPress Plugin

SEOPress, a popular SEO plugin for WordPress, contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-96564. The flaw affects all versions up to and including 10.2. It stems from improper input sanitization and output escaping within the plugin's handling of the Author Display Name. This vulnerability is specific to configurations where the 'Track Authors' custom dimension is active within Google Analytics 4 or Matomo integration settings. When these conditions are met, the plugin includes the unsanitized display name within tracking scripts rendered on public-facing pages. Attackers can leverage this by submitting malicious content through components that allow public singular content creation, such as bbPress, where the injected payload in the display name is later reflected and executed in the browsers of visiting users.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can be used for session hijacking, credential theft, or the silent redirection of users to malicious websites. The impact is significant for sites with high traffic or those relying on third-party forums or user-generated content plugins integrated with SEOPress.

Recommendation

1. Upgrade SEOPress to version 10.3 or later immediately to patch CVE-2026-96564.
2. Audit current plugin settings and temporarily disable the 'Track Authors' feature in Google Analytics 4 or Matomo until the software can be updated.
3. Review logs for suspicious activity originating from public-facing content submission points such as bbPress.