Security Alert Summary
The SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting (XSS) vulnerability that permits authenticated contributors to inject JavaScript into post content. The issue stems from an overly permissive KSES allowlist that permits the onload event handler on iframe elements. Malicious scripts can execute when affected posts are viewed or previewed by higher-privileged users, which may lead to privilege escalation or account compromise.
CVE Details
- CVE ID:
CVE-2026-75134 - Affected component: SEOWriting plugin for WordPress (SEOWriting)
- Affected versions: through 1.12.5 (versions up to and including 1.12.5)
- Published: September 2, 2026 at 8:17:36 PM UTC
- Last modified: September 3, 2026 at 3:17:33 PM UTC
- CVSS v3.1: Base score 6.4 (MEDIUM); Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Authentication: requires an authenticated contributor (as described); Privileges required: LOW (per CVSS v3.1); User interaction: NONE (per CVSS v3.1)
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-site Scripting)
Technical Details
This is a stored XSS vulnerability: the plugin’s KSES allowlist explicitly permits the onload event handler on iframe elements, which is overly permissive. Authenticated contributors can insert crafted iframe markup or other content containing a JavaScript payload into post content. Because the payload is stored with the post, the script executes when the post is viewed or previewed by users with higher privileges (for example, editors or administrators).
The root cause is a missing or insufficient sanitization/restriction in the filtering logic (the KSES allowlist) that should disallow dangerous event handler attributes on allowed elements. The description does not name specific functions or REST endpoints beyond the KSES allowlist and the permitted onload handler.
Impact is limited to actions achievable via client-side script execution in the context of a privileged user’s browser. As described, successful exploitation may enable actions such as session theft or performing actions on behalf of the victim user, which can result in privilege escalation or account compromise depending on the victim’s role.
How This Could Impact Your Website
Consider a typical site with multiple users: an external contractor or contributor creates or edits a post, an internal staff editor previews that post, and the site owner reviews it before publishing. If a contributor stores a malicious iframe with an executable onload payload, that script can run in the browser of the editor or site owner when they view or preview the post. Practical consequences include exposure of session tokens or other data accessible in the privileged users browser context, which can increase the risk of targeted phishing or account takeovers. Internal user email addresses or other information visible to privileged users may be exposed indirectly if scripts exfiltrate such data.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor privileges that allow content creation.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual behavior, especially around post previews and content changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
