The SEOPress – AI SEO Plugin for WordPress is vulnerable to Stored Cross‑Site Scripting because it stores the user’s `display_name` without proper input sanitization. The plugin later inserts a template token (`%%archive_title%%`) before escaping, allowing an attacker to embed HTML event‑handler payloads that execute in the browser of anyone who views a page that renders the token. Attackers with subscriber‑level credentials can set a malicious display name and persist the payload, leading to code execution in the context of site visitors. Affected systems comprise any WordPress installation that has SEOPress version 10.3 or earlier. This includes all editions of the plugin from the beginning of its release history up through 10.3. The flaw resides in the plugin code itself and therefore impacts every WordPress site running these versions, regardless of the underlying PHP or WordPress core version. The CVSS score of 6.4 shows a moderate‑to‑high risk level. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires valid user credentials at the subscriber level or higher and the ability to edit the profile display name. Once the malicious display name is stored, any visitor who views a page that includes the `%%archive_title%%` token will have the injected script executed within their browser.

Any WordPress site running SEOPress version 10.3 or earlier. The plugin is developed by rainbowgeek under the name SEOPress – AI SEO Plugin & On‑site SEO. The vulnerability affects all supported platforms that host the plugin, as the flaw lies in the plugin’s PHP code and is independent of the server environment.

The vulnerability’s CVSS score of 6.4 indicates moderate‑to‑high severity. Because the EPSS score is unavailable and the flaw is not in the CISA KEV catalog, the likelihood of widespread exploitation is unclear, but the requirement for authenticated subscriber access means an attacker can easily gain a valid account via phishing or existing credentials. Once the malicious display name is saved, the stored XSS payload executes automatically for any visitor to a page that emits the `%%archive_title%%` token, potentially compromising user accounts or installing malware. The attacker’s path is straightforward: obtain subscriber credentials, modify the user’s display name to include a crafted `%%archive_title%%` token with an event handler, and wait for visitors to trigger the execution.