CVE-2026-101357 rainbowgeek CVE debrief

Who should care

WordPress administrators and security teams should assess exposure and prioritize remediation for installations using the SEOPress plugin, especially if subscriber-level access or higher has been delegated.

Why it matters

CVE-2026-101357 is a Stored Cross-Site Scripting vulnerability in the SEOPress WordPress plugin. Defenders should assess exposure, prioritize remediation, verify subscriber access, and monitor for suspicious activity.

• Authenticated attackers with subscriber-level access can inject arbitrary web scripts.
• Injected scripts execute when a user accesses an injected page.
• Requires verification of WordPress installations and SEOPress plugin versions.
• Remediation priority depends on the delegation of Analytics management capability to Subscriber roles.

Technical summary

The SEOPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter. This requires an administrator to have delegated the Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings. The vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's insufficient input sanitization and output escaping enable this vulnerability.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the SEOPress plugin, especially if subscriber-level access or higher has been delegated.

Recommended defensive actions

• Assess exposure: Review WordPress installations for SEOPress plugin usage and version.
• Prioritize remediation: Update SEOPress to a fixed version if available.
• Verify subscriber access: Review WordPress user roles and ensure subscriber-level access is properly managed.
• Monitor for suspicious activity: Keep an eye on WordPress site activity for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code. The vulnerability is a Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. The source code review indicates that the plugin does not properly sanitize user input, allowing attackers to inject malicious scripts. Defenders should verify the WordPress installations and 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.