{"id":"CVE-2026-108041","published":"2026-11-04T06:16:57.880","lastModified":"2026-11-04T06:16:57.880","description":"The SEOPress  WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress  WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/5776859a-d381-4e89-b263-4e22a74bfa83/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}