https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 17:23:13 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120552 <p>The SEO Engine – Smart SEO with AI, Schema &amp; Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;title&#39; parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core&#39;s wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.</p> <p>The SEO Engine – Smart SEO with AI, Schema &amp; Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;title&#39; parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core&#39;s wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120552 https://db.gcve.eu/vuln/ghsa-x6h5-q644-mq4f <p>The SEO Engine – Smart SEO with AI, Schema &amp; Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;title&#39; parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core&#39;s wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.</p> <p>The SEO Engine – Smart SEO with AI, Schema &amp; Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;title&#39; parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core&#39;s wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.</p> https://db.gcve.eu/vuln/ghsa-x6h5-q644-mq4f