CVE-2026-96564

{
  "etk_id": "ETK-2026-449",
  "cve_id": "CVE-2026-96564",
  "display_id": "CVE-2026-96564",
  "ghsa_id": "GHSA-2vm8-35r3-2p8v",
  "euvd_id": "EUVD-2026-91905",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in SEOPress author tracking",
  "summary": "SEOPress for WordPress through version 10.2 can store script content through an author display name and render it on affected public pages. An unauthenticated attacker needs the ability to publish public singular content, and the plugin's author-tracking dimension must be enabled in its GA4 or Matomo configuration.",
  "mitigation": "Disable the Track Authors custom dimension in the plugin's GA4 and Matomo settings until an updated release is deployed. Restrict unauthenticated publication of public singular content and review existing published content for untrusted author metadata.",
  "vendor": "rainbowgeek",
  "product": "SEOPress – AI SEO Plugin & On-site SEO",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 10.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "SEOPress – AI SEO Plugin & On-site SEO",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0024,
  "epss_percentile": 0.1372,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 30.284091,
  "t0_at": "2026-10-03T05:29:15.453000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T12:11:49.895795+00:00",
      "days": 0.27956531012731484,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T05:29:15.453000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T05:29:15.453000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T05:29:15.453000+00:00",
      "url": "https://github.com/advisories/GHSA-2vm8-35r3-2p8v"
    }
  }
}