CVE-2026-101357: SEOPress WordPress Plugin XSS Vulnerability

CVE-2026-101357 Overview

CVE-2026-101357 is a Stored Cross-Site Scripting (XSS) vulnerability in the SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress. The flaw affects all versions up to and including 10.2. It originates in the handling of the seopress_google_analytics_matomo_id parameter, which lacks sufficient input sanitization and output escaping [CWE-79]. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when any user visits an affected page. Exploitation requires that an administrator has delegated the Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings.

Critical Impact
Authenticated subscribers can inject persistent JavaScript into WordPress pages, enabling session theft, administrative action hijacking, and client-side redirection when the delegation precondition is met.

Affected Products

SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress, versions up to and including 10.2
WordPress sites that have delegated Analytics management to the Subscriber role
Any user session visiting a page containing the injected payload

Discovery Timeline

2026-10-03 - CVE-2026-101357 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-101357

Vulnerability Analysis

The vulnerability resides in the SEOPress plugin's handling of the Matomo analytics identifier. The seopress_google_analytics_matomo_id parameter is accepted through the plugin's Analytics settings API endpoint and persisted to the WordPress options table. When the plugin later renders this value into pages that integrate Matomo tracking, the stored content is reflected back without adequate escaping. An attacker who supplies HTML or JavaScript in this parameter achieves persistent script execution in the context of every visitor's browser session.

Because the payload is stored, exploitation is reliable and does not require social engineering of a specific target. The scope change in the attack impact reflects that injected scripts execute in the browser security context of other users, including administrators who may trigger privileged actions through the injected code.

Root Cause

The underlying defect is insufficient input sanitization in the plugin's sanitize routine and missing output escaping when the Matomo identifier is written into page output. The relevant code paths are visible in inc/admin/sanitize/Sanitize.php, inc/functions/options-matomo.php, and src/Actions/Api/Options/AnalyticsSettings.php in the SEOPress 10.2 source tree. The sanitize function fails to strip or encode HTML control characters before persisting the Matomo ID, and the rendering function does not apply esc_attr() or esc_html() on output.

Attack Vector

Exploitation requires an authenticated account at the Subscriber level or higher. The attack is only viable where an administrator has explicitly delegated the Analytics management capability to Subscribers through SEOPress's Advanced > Security settings. The attacker submits a crafted Matomo identifier through the Analytics settings API. The payload is stored and executed in the browser of any subsequent visitor to a page where the Matomo integration renders the identifier.

No verified exploit code is available at this time. Technical details are documented in the Wordfence Vulnerability Report and the WordPress SEOPRESS Changeset Overview.

Detection Methods for CVE-2026-101357

Indicators of Compromise

Unexpected HTML tags, <script> elements, or JavaScript event handlers stored in the seopress_google_analytics_matomo_id option within the wp_options table
Outbound requests from site visitors to attacker-controlled domains originating from pages that render the Matomo tracking snippet
Subscriber-role accounts invoking the SEOPress AnalyticsSettings REST API endpoint

Detection Strategies

Query the WordPress options table for the seopress_google_analytics_matomo_id value and alert on any content containing <, >, quotes, or javascript: substrings
Review web server access logs for POST or PUT requests to the SEOPress Analytics settings REST route by non-administrative users
Inspect rendered pages for anomalous script tags or inline event handlers appearing near Matomo tracking code

Monitoring Recommendations

Monitor WordPress audit logs for role capability changes, especially delegation of Analytics management to Subscribers
Track creation of new Subscriber accounts followed shortly by activity against plugin settings APIs
Alert on changes to SEOPress option keys using file integrity and database integrity monitoring

How to Mitigate CVE-2026-101357

Immediate Actions Required

Update the SEOPress plugin to a version released after 10.2 that incorporates the fix referenced in the plugin changeset
Revoke any delegation of Analytics management capability from the Subscriber role in SEOPress Advanced > Security settings until patched
Audit the seopress_google_analytics_matomo_id option for malicious content and reset it to a known-good value
Review Subscriber accounts for suspicious registrations and disable or delete those that are not legitimate

Patch Information

The SEOPress maintainers addressed the vulnerability in a plugin update tracked by the WordPress SEOPRESS Changeset Overview. Administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the fixed release.

Workarounds

Do not delegate the Analytics management capability to the Subscriber role; keep it restricted to Administrators
Restrict user registration or require manual approval for new accounts to limit exposure of the authenticated attack surface
Deploy a web application firewall rule that blocks requests to the SEOPress Analytics settings endpoint containing HTML or script syntax in the Matomo identifier field

bash

# Example: remove Analytics management capability from the Subscriber role via WP-CLI
wp cap remove subscriber seopress_manage_analytics
wp option get seopress_google_analytics_matomo_id
wp option update seopress_google_analytics_matomo_id ''