What’s Vulnerable › Vulnerabilities

CVE-2026-75134: SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-09-14
• Weakness: CWE-79

Description

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.

Affected products

• SEOWriting: through 1.12.5

References

• https://github.com/Elymaro/CVE/blob/main/WordPress/CVE-2026-75134.md
• https://wordpress.org/plugins/seowriting/
• https://www.vulncheck.com/advisories/seowriting-wordpress-plugin-stored-xss-via-iframe-onload

Get alerted when CVE-2026-75134 or the next vulnerability affects your stack