Description

Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:34.937Z",
  "pubdate": "2026-08-20T12:16:34.937Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the SEO Plugin by Squirrly SEO affecting versions 14.2.2 and prior. This security flaw enables remote attackers to inject arbitrary malicious client-side scripts, typically JavaScript, into web pages rendered to legitimate site visitors and administrators. The vulnerability poses a significant risk to the integrity and confidentiality of the affected web application. Successful exploitation can lead to severe security implications, including session hijacking, credential theft, unauthorized actions performed on behalf of authenticated users, and defacement of the affected WordPress site. The attack requires zero authentication, meaning any unauthenticated remote user can initiate the exploit vector over the network simply by interacting with vulnerable parameters handled by the plugin. Exploitation prerequisites are minimal, relying entirely on the target application running an unsupported, vulnerable version of the software where input sanitization and output encoding are inadequately implemented within the affected HTTP request handling lifecycle.",
  "technicalDetails": "The vulnerability stems from insufficient sanitization of user-supplied input and a lack of proper contextual output encoding within the SEO Plugin by Squirrly SEO. Specifically, the vulnerable component processes incoming HTTP parameters and improperly reflects them back in the Hypertext Markup Language (HTML) response without neutralizing executable script contexts.\nRoot Cause: The root cause of the vulnerability is the absence of rigorous input validation and secure output escaping mechanisms inside the plugin's request handling routines. When parameters are processed and subsequently rendered in the Document Object Model (DOM), malicious payloads are treated as executable code by the victim browser rather than inert string data.\nAttack Flow: An unauthenticated attacker crafts a malicious Uniform Resource Locator (URL) containing an encoded JavaScript payload within vulnerable input vectors handled by the plugin. The attacker then induces a victim—such as an authenticated site administrator or a standard site visitor—to click the crafted link or visit the compromised endpoint over the network using standard web protocols (HTTP/HTTPS). Upon processing the request, the vulnerable plugin reflects the unescaped payload directly into the HTTP response body. When the victim's browser parses the response, the injected JavaScript executes within the security context of the victim's session.\nPrivilege and Authentication Requirements: No authentication or specific user privileges are required to deliver the payload, classifying this as an unauthenticated vector. Network exposure is external, accessible via standard web traffic.\nPayload Behavior and Impact: The injected script executes in the browser of any user who accesses the maliciously crafted URL. If the victim holds administrative privileges, the payload can perform privileged actions such as creating malicious administrator accounts, installing backdoors via arbitrary plugin uploads, or modifying core site configurations. For standard users or visitors, the payload can facilitate session token theft, cookie exfiltration, and redirection to malicious external phishing sites."
}