The SEO Plugin by Squirrly SEO, versions up to and including 14.0.0, has a leaking API token and insufficient input sanitization and escaping in the savePost() endpoint. An attacker who does not need to authenticate can use the exposed token to create arbitrary posts. If the Advanced Custom Fields plugin is active, the attacker can also inject persistent data resulting in stored cross‑site scripting against users who view the affected pages. This is a CWE-862 missing authorization weakness that compromises data integrity and can expose user sessions or deface content.

WordPress sites that have the Squirrly SEO plugin version up to and including 14.0.0. Any such installation with the Advanced Custom Fields plugin enabled is also vulnerable to stored XSS. Sites without Advanced Custom Fields are limited to arbitrary post creation but not cross‑site scripting via this vector.

With a CVSS score of 7.2 the vulnerability is classified as high risk. The EPSS score is less than 1%, indicating a very low probability of widespread exploitation, and the issue is not listed in CISA KEV. The flaw does not require authentication; an attacker can send a crafted request to the public savePost() endpoint using the leaked API token to create posts or inject scripts when Advanced Custom Fields is present; no additional privileges are required.