CVE-2026-1667: Squirrly SEO Plugin XSS Vulnerability

CVE-2026-1667 Overview

CVE-2026-1667 affects the SEO Plugin by Squirrly SEO for WordPress in all versions up to and including 14.0.0. The vulnerability stems from a leaked API token combined with insufficient input sanitization and output escaping. Unauthenticated attackers can create arbitrary posts on affected WordPress sites. When the Advanced Custom Fields (ACF) plugin is installed and activated, attackers can also inject arbitrary web scripts into pages, executing whenever a user visits the injected content. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can create arbitrary WordPress posts and, when ACF is active, achieve stored cross-site scripting against site visitors and administrators.

Affected Products

SEO Plugin by Squirrly SEO for WordPress — all versions up to and including 14.0.0
WordPress sites with Squirrly SEO installed and the Advanced Custom Fields plugin activated (required for the stored XSS path)
Any WordPress deployment exposing the vulnerable Squirrly SEO endpoints to the internet

Discovery Timeline

2026-07-10 - CVE-2026-1667 published to the National Vulnerability Database
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-1667

Vulnerability Analysis

The vulnerability combines two distinct security failures in the Squirrly SEO plugin. First, an API token used to authorize privileged operations is leaked, allowing unauthenticated actors to reach functionality that should require an authenticated session. Second, the affected code paths fail to sanitize input and escape output when processing post content and custom field data.

Attackers exploit the exposed token to invoke post-creation routines without valid WordPress credentials. Any content injected through these routines is stored in the WordPress database. When the Advanced Custom Fields plugin renders that data on a public or administrative page, unsanitized script payloads execute in the browser of the visiting user.

Stored XSS through this vector enables session hijacking, administrative account takeover, malicious redirects, and delivery of secondary payloads to site visitors.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in the plugin's REST or AJAX handlers, compounded by trust in a client-accessible API token. Sanitization functions such as wp_kses_post() or sanitize_text_field(), and output escaping through esc_html() or esc_attr(), are either absent or bypassed on the affected code path.

Attack Vector

Exploitation occurs over the network with low attack complexity and requires no authentication or user interaction. An attacker discovers the leaked API token, then issues crafted HTTP requests to the vulnerable Squirrly SEO endpoint. The request payload includes post content and, where ACF is present, custom field values containing JavaScript. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the specific handler and diff.

No verified public exploit code is available at this time; refer to the vendor changeset for the authoritative fix details.

Detection Methods for CVE-2026-1667

Indicators of Compromise

Unexpected WordPress posts authored by system or unknown accounts, particularly those created without a corresponding administrator login event.
HTTP POST requests to Squirrly SEO REST or AJAX endpoints from unauthenticated sources referencing an API token parameter.
Post content or ACF field values containing <script> tags, javascript: URIs, or event handlers such as onerror= and onload=.
Outbound requests from browsers of authenticated administrators to attacker-controlled domains shortly after visiting plugin-rendered pages.

Detection Strategies

Inspect WordPress access logs for unauthenticated requests to Squirrly SEO endpoints that carry token parameters and result in 200 responses.
Query the wp_posts and wp_postmeta tables for recently created rows containing HTML script constructs or unusual authors.
Monitor web application firewall telemetry for anomalous request patterns targeting the plugin path /wp-content/plugins/squirrly-seo/.

Monitoring Recommendations

Alert on new post creation events that occur outside authenticated administrator sessions, correlating web server logs with WordPress audit logs.
Enable file integrity monitoring on the WordPress plugins directory to detect tampering and confirm the patched Squirrly SEO version is deployed.
Track outbound network connections from browsers that recently rendered pages served by the affected site to identify successful XSS execution.

How to Mitigate CVE-2026-1667

Immediate Actions Required

Update the SEO Plugin by Squirrly SEO to a version later than 14.0.0 that includes the fix referenced in the WordPress Plugin Changeset.
Audit all WordPress posts created since the plugin was installed, focusing on entries with unknown authors or embedded scripts, and remove malicious content.
Rotate any API tokens, administrator passwords, and secret keys defined in wp-config.php, and invalidate active sessions.

Patch Information

The vendor addressed the vulnerability in the Squirrly SEO repository at revision 3586051, superseding revision 3474256. Site owners should upgrade through the WordPress plugin manager or apply the vendor-supplied release directly. The Wordfence advisory tracks this fix under vulnerability identifier aebdd464-10b9-4d43-bf38-f0e8ae25625f.

Workarounds

If immediate patching is not possible, deactivate and remove the Squirrly SEO plugin until a fixed version is installed.
Temporarily deactivate the Advanced Custom Fields plugin to eliminate the stored XSS execution path while retaining SEO functionality.
Deploy a web application firewall rule blocking unauthenticated POST requests to Squirrly SEO endpoints and stripping <script> tags from inbound parameters.

bash

# Example WP-CLI commands to update the plugin and verify version
wp plugin update squirrly-seo
wp plugin get squirrly-seo --field=version

# Temporary workaround: deactivate the vulnerable plugin
wp plugin deactivate squirrly-seo