CVE-2026-108041
Last modified
CVE-2026-108041 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | SEOPress | < 10.4 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-108041?
How severe is CVE-2026-108041?
How do I fix CVE-2026-108041?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-108014Private keys for eight eMudhra intermediate CA certificates …9.1
- CVE-2026-108015Private keys for eight eMudhra intermediate CA certificates …9.1
- CVE-2026-10802A vulnerability was detected in keystonejs keystone up to 20…4.3
- CVE-2026-10803A flaw has been found in MLflow up to 3.10.0. This issue aff…3.6
- CVE-2026-108039By default, StaxUtils placed no limit on the total number of…7.5
- CVE-2026-10804A vulnerability has been found in Streamlit up to 1.53.0. Im…4.7
- CVE-2026-108046Direct Object Reference (IDOR) vulnerability in Alosuite due…6.9
- CVE-2026-108047Inadequate authorization vulnerability in Alosuite’s user in…8.6
- CVE-2026-108048Vulnerability due to a lack of request limits in Alosuite’s …6.9
- CVE-2026-108049Clickjacking vulnerability in the Alosuite web application. …5.1
- CVE-2026-10805A flaw was found in NetworkManager. This local privilege esc…6.7
- CVE-2026-108050A stored Cross-Site Scripting (XSS) vulnerability in Alosuit…5.1
Are you affected by CVE-2026-108041?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST