Vulnerability · Published Sep 2, 2026 · Assigned by VulnCheck

CVE-2026-75134SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload

Medium 6.4

In plain English

A medium-severity cross-site scripting in SEOWriting from SEOWriting. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 74.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.

Affected products (as reported)

Vendor	Product	Versions
SEOWriting	SEOWriting	0 – through 1.12.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

Researcher Disclosure technical-description, exploit
WordPress Plugin Webpage product
https://www.vulncheck.com/advisories/seowriting-wordpress-plugin-stored-xss-via-iframe-onload third-party-advisory