blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-75134

MEDIUM 5.1 CVSS 4.0
Published
September 2, 2026
Last modified
September 14, 2026
NVD status
Deferred
Reported by
disclosure@vulncheck.com
Weakness
CWE-79
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • SEOWriting SEOWriting — Up to and including 1.12.5

References

  • github.com https://github.com/Elymaro/CVE/blob/main/WordPress/CVE-2026-75134.md
  • wordpress.org https://wordpress.org/plugins/seowriting/
  • www.vulncheck.com https://www.vulncheck.com/advisories/seowriting-wordpress-plugin-stored-xss-via-iframe-onload
  • nvd.nist.gov Official NVD record