Vulnerability in SEOWriting — CVE-2026-75134

What to do now

No fix has been published yet. Consider disabling SEOWriting for now, or moving to an alternative.

Affected versions

• Everything up to and including 1.12.5

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.

This description is reproduced verbatim from the public vulnerability record.

• https://github.com/Elymaro/CVE/blob/main/WordPress/CVE-2026-75134.md
• https://wordpress.org/plugins/seowriting/
• https://www.vulncheck.com/advisories/seowriting-wordpress-plugin-stored-xss-via-iframe-onload

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.