CVE-2026-75134— SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload
Quick assessment
Affected
SEOWriting SEOWriting
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 SEOWriting 在 1.12.5 及更早版本中存在一个存储型跨站脚本（Stored XSS）漏洞。该漏洞允许已认证的投稿者（contributors）利用对 元素过于宽松的 KSES 白名单机制——该白名单明确允许 事件处理程序——来注入恶意 JavaScript 代码。攻击者可以在帖子内容中植入精心构造的 JavaScript 载荷，这些载荷会在高权限用户查看或预览受影响的帖子时执行，可能导致权限提升或账户被盗用。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SEOWriting | SEOWriting | ≤ 1.12.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75134
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload
Source: CVE Program / CVE List V5
Vulnerability Description
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SEOWriting | SEOWriting | 0 ~ 1.12.5 | - |
|
II. Public POCs for CVE-2026-75134
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75134
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-75134 (1)
Proof of Concept for CVE-2026-75134 (1)
-
🔗 CVE/WordPress/CVE-2026-75134.md at main · Elymaro/CVE · GitHub Read full article technical-description exploit
Vendor Pages for CVE-2026-75134 (1)
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-18986
Entity Browser - Moderately critical - Cross site scripting -
CVE-2026-81167
Address Suggestion - Moderately critical - Cross-site script -
CVE-2026-81201
Monster Menus - Moderately critical - Cross-site Scripting - -
CVE-2026-81160
Slick Carousel - Moderately critical - Cross Site Scripting -
CVE-2026-83562
WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scri
V. Comments for CVE-2026-75134
No comments yet