CVE-2026-75134 Overview
CVE-2026-75134 is a stored cross-site scripting (XSS) vulnerability in the SEOWriting plugin for WordPress through version 1.12.5. The plugin ships an overly permissive KSES allowlist that explicitly permits the onload event handler on <iframe> elements. Authenticated contributors can store crafted JavaScript payloads inside post content. The payload executes when a higher-privileged user, such as an editor or administrator, views or previews the post. Successful exploitation can lead to session theft, account compromise, or privilege escalation within the WordPress site. The weakness is tracked under CWE-79.
Critical Impact
Authenticated contributors can execute arbitrary JavaScript in the browsers of administrators who preview affected posts, enabling account takeover of the WordPress site.
Affected Products
- WordPress SEOWriting plugin versions up to and including 1.12.5
- WordPress sites that allow contributor-level user registration with the plugin installed
- Multi-author WordPress environments using SEOWriting for content publishing
Discovery Timeline
- 2026-09-02 - CVE-2026-75134 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-75134
Vulnerability Analysis
The SEOWriting plugin extends the WordPress KSES (Kses Strips Evil Scripts) sanitization allowlist to accept <iframe> elements together with the onload attribute. KSES is the built-in content filter WordPress uses to strip dangerous HTML from user-submitted post content. By allowlisting onload on iframe, the plugin permits a JavaScript execution vector that WordPress core normally blocks for non-unfiltered_html users.
Contributors in WordPress lack the unfiltered_html capability by default. This vulnerability effectively grants them a scripting primitive they should not have. When a stored payload is later rendered in an authenticated context, such as an editor previewing the post for approval, the script runs with that user's session.
Root Cause
The root cause is improper input neutralization during web page generation [CWE-79]. The plugin's KSES configuration adds iframe with the onload handler to the list of tags and attributes considered safe. WordPress then persists the tag intact when a contributor saves the post, and re-emits it during rendering without further sanitization.
Attack Vector
Exploitation requires an authenticated account at contributor privilege level or higher. The attacker submits a post containing an <iframe> element whose onload attribute holds JavaScript. The payload is stored in the wp_posts table. When a reviewer opens the post preview or the post is otherwise rendered in the WordPress admin, the script executes in that reviewer's browser. User interaction from a privileged user is required for the payload to fire, which is reflected in the CVSS UI:P metric.
Refer to the GitHub proof of concept for CVE-2026-75134 and the VulnCheck advisory on the iframe onload XSS for the payload structure and reproduction steps.
Detection Methods for CVE-2026-75134
Indicators of Compromise
- Post content in wp_posts containing <iframe> tags with onload= attributes authored by contributor-role accounts
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after post previews
- New administrator accounts, altered user roles, or modified plugin/theme files created during or immediately after editorial preview sessions
Detection Strategies
- Query the WordPress database for stored posts matching the pattern <iframe[^>]*onload= and review the author role
- Inspect plugin source at wp-content/plugins/seowriting/ for KSES allowlist modifications that include iframe and onload
- Monitor WordPress audit logs for post creation and preview actions correlated with role-based access to /wp-admin/post.php
Monitoring Recommendations
- Enable a WordPress activity logging plugin to track contributor post submissions and administrator preview events
- Forward web server access logs to a centralized log platform and alert on anomalous outbound requests initiated from /wp-admin/ sessions
- Watch for changes to privileged user accounts (role elevations, email changes, application password creation) following contributor activity
How to Mitigate CVE-2026-75134
Immediate Actions Required
- Restrict contributor-level registration and audit existing contributor accounts until a patched release is applied
- Instruct editors and administrators to avoid previewing posts from untrusted contributors until the plugin is updated
- Purge or manually review any stored posts containing <iframe> tags submitted by non-administrator users
Patch Information
At the time of publication, the NVD entry for CVE-2026-75134 does not list a fixed version. Monitor the SEOWriting plugin page on WordPress.org and the VulnCheck advisory for a release that removes iframe and the onload attribute from the plugin's KSES allowlist. Update to the fixed version immediately once available.
Workarounds
- Deactivate the SEOWriting plugin on sites that accept content from contributor-role users until a patch is released
- Apply a Content-Security-Policy header on the WordPress admin area that disallows inline scripts and untrusted frame sources
- Add a must-use plugin that filters iframe and event-handler attributes out of post content on save via the content_save_pre hook
# Temporarily disable the plugin via WP-CLI until a patched version is released
wp plugin deactivate seowriting
# Identify stored posts containing iframe onload payloads
wp db query "SELECT ID, post_author, post_status FROM wp_posts \
WHERE post_content REGEXP '<iframe[^>]*onload=';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
