Vulnerability · Published Aug 6, 2026 · Assigned by WPScan

CVE-2026-11588EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation

Medium 6.1

In plain English

A medium-severity cross-site scripting in EONSR AEO Agent from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 80.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts that execute in the browser of any visitor, including administrators (Stored XSS).

Affected products (as reported)

Vendor	Product	Versions
Unknown	EONSR AEO Agent	0 – through 3.7.9

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/31381157-63d6-4c26-bd52-2039a2e1a804/ exploit, vdb-entry, technical-description