WordPress plugin
SEOPress – AI SEO Plugin & On-site SEO security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High1
- Medium18
- Low0
All SEOPress – AI SEO Plugin & On-site SEO vulnerabilities
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters
≤10.3Update to 10.4
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
<10.4Update to 10.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag
≤10.3Update to 10.4
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter
≤10.2Update to 10.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Author Display Name
≤10.2Update to 10.3
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
≤10.1Update to 10.2
- Medium4.3Missing Authorization
≤8.1.1Update to 8.2
- Medium4.3Missing Authorization
≤8.1.1Update to 8.2
- Medium5.3Missing Authorization
≤8.1.1Update to 8.2
- Medium6.1Reflected Cross-Site Scripting
≤8.1.1Update to 8.2
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL
≤7.9Update to 7.9.1
- Critical9.0Unauthenticated PHP Object Injection
≤7.8Update to 7.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.7.2Update to 7.8
- Medium6.4Authenticated (Contributor+) Open Redirect
≤7.7.2Update to 7.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.5.2.1Update to 7.6
- Medium5.3Information Exposure
≤7.6.1Update to 7.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤7.5.2.1Update to 7.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤7.2Update to 7.3
- Medium6.6Authenticated (Administrator+) PHP Object Injection
≤6.5.0.2Update to 6.5.0.3
- Medium6.45.0.3 - Stored Cross-Site Scripting
≤5.0.3Update to 5.0.4
SEOPress – AI SEO Plugin & On-site SEO: common questions
Does SEOPress – AI SEO Plugin & On-site SEO have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in SEOPress – AI SEO Plugin & On-site SEO: 1 critical, 1 high, 18 medium. None are known to affect version null.
How do I check which version of SEOPress – AI SEO Plugin & On-site SEO I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent SEOPress – AI SEO Plugin & On-site SEO vulnerability?
CVE-2026-120515, published Nov 6, 2026: SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters. Severity: Medium (CVSS 6.4).
Is any SEOPress – AI SEO Plugin & On-site SEO vulnerability listed in CISA KEV?
No. None of the known SEOPress – AI SEO Plugin & On-site SEO vulnerabilities is currently listed in the CISA KEV catalog.