Description
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
Published: 2026-08-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated Cross Site Scripting vulnerability exists in the SEO Plugin by Squirrly SEO, allowing an attacker to inject malicious script into the plugin’s output. This can lead to session hijacking, defacement, theft of user credentials, or the execution of additional malicious code on victims’ browsers, compromising confidentiality, integrity, and availability for users who access the affected site.

Affected Systems

WordPress SEO Plugin by Squirrly SEO, versions released up to 14.2.2. Site owners running any of those versions should consider themselves affected.

Risk and Exploitability

The vulnerability presents a moderate CVSS score of 7.1 and is not currently listed in the CISA KEV catalog. The EPSS score is not available, indicating no current exploitation data. Attackers can exploit this XSS flaw by sending crafted input to the plugin without authentication, making it widely accessible. Because of the unauthenticated nature, anyone visiting the site can trigger the injection, increasing the risk surface.

Generated by OpenCVE AI on August 20, 2026 at 21:45 UTC.

Remediation

Vendor Solution

Update the WordPress SEO Plugin by Squirrly SEO Plugin to the latest available version (at least 14.2.3).

OpenCVE Recommended Actions

  • Apply the vendor‑recommended patch by updating the Squirrly SEO plugin to version 14.2.3 or later.
  • If updating is not immediately possible, disable or remove the plugin from the site until the patch is applied to eliminate the XSS vector.
  • Implement Content Security Policy rules to mitigate the impact of any remaining script injection risks and monitor site activity for suspicious script execution.

Generated by OpenCVE AI on August 20, 2026 at 21:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Squirrly
Squirrly seo Plugin By Squirrly Seo
Wordpress
Wordpress wordpress
Vendors & Products Squirrly
Squirrly seo Plugin By Squirrly Seo
Wordpress
Wordpress wordpress

Thu, 20 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
Title WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Squirrly Seo Plugin By Squirrly Seo
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-20T14:33:59.957Z

Reserved: 2026-07-27T14:00:21.730Z

Link: CVE-2026-66614

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-20T12:16:34.937

Modified: 2026-08-20T15:18:17.820

Link: CVE-2026-66614

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T13:01:52Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')