CVE-2026-96564: SEOPress WordPress Plugin XSS Vulnerability

CVE-2026-96564 Overview

CVE-2026-96564 is a Stored Cross-Site Scripting (XSS) vulnerability in the SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress. The flaw affects all versions up to and including 10.2. It stems from insufficient input sanitization and output escaping of the Author Display Name when rendered inside Google Analytics 4 (GA4) or Matomo tracking scripts. Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of any visitor loading an affected page. The vulnerability is tracked under [CWE-79].

Critical Impact
An unauthenticated attacker who can publish public singular content (for example, via bbPress forum topics) can inject persistent JavaScript into the tracking script output, enabling session theft, redirects, or admin account takeover.

Affected Products

SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress
All versions up to and including 10.2
Configurations with the Track Authors custom dimension enabled in GA4 or Matomo settings

Discovery Timeline

2026-10-03 - CVE-2026-96564 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-96564

Vulnerability Analysis

The SEOPress plugin injects author metadata into client-side analytics tracking code. When the Track Authors custom dimension is enabled for GA4 or Matomo, the plugin reads the post author's display_name and embeds it into the inline tracking JavaScript on singular post or page views. The plugin fails to sanitize this value on input and does not escape it for a JavaScript context on output. An attacker who can create a user account with a crafted display name, and who can publish public singular content, triggers execution of attacker-controlled script in every visitor's browser. Platforms that allow unauthenticated or low-privilege content publication, such as bbPress forum integrations, satisfy this precondition.

Root Cause

The root cause is missing context-aware escaping in the GA4 and Matomo options modules. The vulnerable code paths render author data directly into inline <script> blocks in inc/functions/options-google-analytics.php (line 635) and inc/functions/options-matomo.php (line 118). See the WordPress SEOPress GA Options Code and WordPress SEOPress Matomo Options Code for the pre-patch logic.

Attack Vector

The attack vector is network-based and requires no authentication when the target site exposes a public content-publishing surface such as bbPress. An attacker registers an account, sets the display name to a JavaScript payload, and publishes a public forum topic or similar singular content. When any visitor loads that content, the plugin injects the unsanitized display name into the inline tracking script, and the payload executes in the visitor's browser session. A single injected payload can target site administrators, enabling cookie theft, forced actions via the WordPress REST API, or persistent backdoor installation.

Detection Methods for CVE-2026-96564

Indicators of Compromise

WordPress user accounts whose display_name field contains HTML tags, <script> fragments, or JavaScript event handlers such as onerror=.
Outbound HTTP requests from site visitors to unexpected domains originating from analytics <script> blocks on singular post pages.
New administrator accounts, modified plugin files, or unexpected scheduled tasks (wp_cron events) created shortly after public forum activity.
Entries in wp_posts from unauthenticated or newly registered users containing suspicious author metadata.

Detection Strategies

Query the wp_users table for display_name values containing <, >, script, onerror, onload, or javascript: substrings.
Inspect rendered HTML of public singular posts and compare the GA4 or Matomo inline tracking blocks against expected templates.
Review web server access logs for POST requests to bbPress or similar public content endpoints followed by anomalous visitor-side activity.
Correlate WordPress audit logs with analytics configuration changes affecting the Track Authors custom dimension.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to surface inline script execution anomalies on public pages.
Forward WordPress and web server logs to a centralized analytics platform and alert on new user registrations followed by immediate content publication.
Monitor for integrity changes to plugin files under wp-content/plugins/wp-seopress/ after applying the patch.

How to Mitigate CVE-2026-96564

Immediate Actions Required

Update the SEOPress plugin to the version containing WordPress SEOPress Changeset 3722789, which addresses the output escaping flaw.
Audit all WordPress user accounts and sanitize or remove any display_name values containing HTML or JavaScript syntax.
Review bbPress or other public publishing integrations and restrict unauthenticated or self-service account creation where feasible.
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found.

Patch Information

The vendor addressed CVE-2026-96564 in the SEOPress plugin via changeset 3722789. The fix adds proper context-aware escaping of the author display name before it is written into the GA4 and Matomo inline tracking scripts. Administrators should upgrade beyond version 10.2. Technical details are documented in the Wordfence Vulnerability Analysis.

Workarounds

Disable the Track Authors custom dimension in the SEOPress GA4 and Matomo configuration until the patch is applied.
Restrict public content publication by requiring administrator approval for new forum topics or author accounts.
Deploy a web application firewall (WAF) rule that blocks user registration requests containing script tags or JavaScript event handlers in the display name field.

bash

# Configuration example: WP-CLI commands to audit and remediate
# List users whose display_name contains suspicious characters
wp user list --fields=ID,user_login,display_name --format=csv \
  | grep -Ei '<|>|script|onerror|onload|javascript:'

# Update the SEOPress plugin to the patched version
wp plugin update wp-seopress

# Verify the installed version
wp plugin get wp-seopress --field=version