Description

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-02T20:17:36.577Z",
  "pubdate": "2026-09-02T20:17:36.577Z",
  "executiveSummary": "The SEOWriting plugin for WordPress, up to and including version 1.12.5, is susceptible to a stored cross-site scripting (XSS) vulnerability.\nThis security flaw stems from an insecure KSES (Kses) allowlist configuration that improperly validates HTML input, specifically permitting the execution of JavaScript via the 'onload' attribute within 'iframe' elements.\nThe vulnerability allows authenticated users with at least 'contributor' privileges to inject malicious scripts into post content. When a high-privileged user, such as an administrator, views or previews the compromised content, the script executes within the victim's browser session.\nThe risk implications are critical, as the injected code operates under the security context of the victim's session. This enables attackers to perform unauthorized actions, including the potential for privilege escalation, session hijacking, or exfiltration of sensitive administrative data.\nSuccessful exploitation requires authenticated access to the WordPress dashboard with sufficient permissions to create or edit posts. No external network exposure is required for the initial injection; however, the impact is realized through the interaction between the attacker and a privileged user account.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of WordPress's kses filtering mechanism within the SEOWriting plugin. WordPress utilizes kses to sanitize HTML input, stripping potentially malicious tags and attributes based on a predefined allowlist. In versions 1.12.5 and below, the plugin's configuration explicitly adds the 'onload' attribute to the list of permitted attributes for the 'iframe' HTML tag.\nThe 'onload' event handler is a standard HTML attribute that triggers execution when the frame finishes loading. By permitting this attribute, the plugin bypasses security controls designed to prevent XSS. An attacker authenticated with 'contributor' level access or higher can insert an iframe element into a post or page. By crafting a payload such as <iframe src='javascript:alert(1)' onload='[malicious_javascript_payload]'></iframe>, the attacker ensures that the JavaScript is executed as soon as the iframe object is rendered.\nThe attack flow begins when the authenticated attacker saves a crafted post containing the malicious iframe. Because the plugin's filter allows this specific configuration, the payload is persisted in the WordPress database without being sanitized. The vulnerability remains dormant until a user with elevated privileges (e.g., an Editor or Administrator) accesses the post's permalink or the preview functionality in the dashboard.\nUpon loading the page, the victim's browser initiates the rendering of the malicious iframe, subsequently triggering the 'onload' event handler. The injected JavaScript payload executes in the context of the victim's session, granting the attacker the ability to perform any action the victim is authorized to perform via the WordPress REST API or administrative dashboard.\nPost-exploitation impact is severe, as it facilitates the execution of unauthorized administrative operations. This can include creating new user accounts with administrative rights, modifying site configurations, or injecting additional backdoors into the theme or plugin files to ensure long-term persistence within the environment."
}