CVE-2026-19988: Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-17 · updated 2026-08-20
Weakness: CWE-74

Description

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Alaev SEO Tools Extension: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+5)

References

https://github.com/xryj920/chrome_extensions/blob/main/Alaev%20%26%20Co%20Alaev%20SEO%20Tools%201.0.10%20allows%20extension%20popup%20UI%20injection%20through%20unsanitized%20page%20SEO%20fields
https://vuldb.com/cve/CVE-2026-19988
https://vuldb.com/submit/873939
https://vuldb.com/vuln/391192
https://vuldb.com/vuln/391192/cti

Get alerted when CVE-2026-19988 or the next vulnerability affects your stack