CVE-2026-11588: EONSR AEO Agent WordPress XSS Flaw

CVE-2026-11588 Overview

CVE-2026-11588 affects the EONSR AEO Agent WordPress plugin through version 3.7.9. The plugin exposes a REST API route without any authorisation check and disables HTML sanitisation before persisting post content. Unauthenticated attackers can create administrator-attributed, published posts containing arbitrary JavaScript. The injected scripts execute in the browser of any visitor, including authenticated administrators viewing the affected site.

Critical Impact
Unauthenticated attackers can plant Stored Cross-Site Scripting (XSS) payloads that execute in administrator sessions, enabling account takeover of the entire WordPress site.

Affected Products

EONSR AEO Agent WordPress plugin, all versions through 3.7.9

Discovery Timeline

2026-08-06 - CVE-2026-11588 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-11588

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw compounded by Broken Access Control. The EONSR AEO Agent plugin registers a REST API route that accepts post content from any caller. The route does not verify capabilities, nonces, or authentication before creating a post.

Before saving the submitted content, the plugin explicitly disables the WordPress HTML sanitisation layer. This means any <script> tags or event handler attributes in the payload are stored verbatim. The resulting posts are attributed to an administrator account and published to the site.

When a visitor or administrator loads the malicious post, the browser executes the attacker's JavaScript in the site's origin. An attacker can hijack administrator sessions, create rogue admin users, install backdoored plugins, or exfiltrate site data.

Root Cause

Two defects combine to enable exploitation. First, the REST API endpoint lacks a permission_callback that enforces authorisation, so any anonymous request is accepted. Second, the plugin removes the default kses sanitisation filters before calling wp_insert_post(), so the untrusted HTML is stored without escaping.

Attack Vector

Exploitation requires only network access to the target site's REST API. An attacker sends a crafted HTTP POST request to the vulnerable plugin route, including HTML with embedded JavaScript in the post body. The plugin creates a published post authored by an administrator and stores the raw script. The payload executes on every subsequent view of the post.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-11588

Indicators of Compromise

Newly published WordPress posts attributed to administrator accounts that contain <script> tags, inline event handlers, or obfuscated JavaScript.
Unexpected POST requests to the EONSR AEO Agent REST API namespace from unauthenticated sources in web server access logs.
Creation of new administrator users, unknown plugin installations, or modifications to wp_options following anomalous REST traffic.

Detection Strategies

Query the WordPress database for posts containing <script, onerror=, or onload= in post_content, especially those created without a corresponding editor login event.
Correlate REST API request logs with WordPress audit logs to identify post creation events that lack a preceding authenticated session.
Baseline normal REST API traffic patterns for the plugin and alert on requests from unauthenticated clients.

Monitoring Recommendations

Enable a WordPress activity log plugin to record post creation, user creation, and plugin changes with source IP attribution.
Deploy a Web Application Firewall (WAF) rule to flag POST requests to /wp-json/ routes that contain script tags or common XSS payloads.
Monitor outbound requests from administrator browsers for unexpected connections that may indicate active session hijacking.

How to Mitigate CVE-2026-11588

Immediate Actions Required

Deactivate and remove the EONSR AEO Agent plugin until a fixed version is released and verified.
Audit all WordPress posts for injected scripts and remove or sanitise any content originating from the vulnerable endpoint.
Rotate administrator passwords, invalidate active sessions, and review the user list for unauthorised accounts.

Patch Information

At the time of publication no fixed version has been identified in the referenced advisory. Monitor the WPScan Vulnerability Report and the vendor's plugin page for a security release beyond version 3.7.9.

Workarounds

Block unauthenticated access to the plugin's REST API namespace at the WAF or reverse proxy layer until a patch is available.
Restrict access to /wp-json/ endpoints to authenticated sessions using server-side authentication rules.
Apply Content Security Policy (CSP) headers that disallow inline scripts to reduce the impact of stored XSS payloads.

bash

# Example nginx rule to block unauthenticated access to the plugin REST namespace
location ~ ^/wp-json/eonsr-aeo-agent/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}