{"id":"CVE-2026-108041","title":"SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings","summary":"The SEOPress  WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress  WordPress plug…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-79"],"product":"SEOPress","affected":["SEOPress < 10.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-04T14:06:39.556457Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:22.636Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108041","references":[{"url":"https://wpscan.com/vulnerability/5776859a-d381-4e89-b263-4e22a74bfa83/"}],"tags":["cve.org"],"epss":0.00294,"epssPercentile":0.22104,"ingestedAt":"2026-11-05T21:36:00.373Z","slug":"CVE-2026-108041","body":"## Overview\n\nThe SEOPress  WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress  WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.\n\n## Affected\n\n- `SEOPress < 10.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}