Executive brief
SEOWriting is a popular WordPress plugin that generates AI-written articles and publishes them to WordPress sites. The plugin contains a stored cross-site scripting (XSS) vulnerability in its HTML sanitization logic that allows contributors to inject malicious JavaScript into posts. When higher-privileged users like editors or administrators preview or view affected posts, the malicious code executes in their browsers, potentially leading to session hijacking, account compromise, or unauthorized administrative actions.
Technical details
This is an authenticated stored XSS vulnerability in the SEOWriting WordPress plugin through version 1.12.5. The root cause is an overly permissive KSES allowlist modification that explicitly permits the onload event handler on iframe elements—a combination that WordPress's default sanitization does not allow. An attacker with Contributor role or higher can craft a post containing an iframe with an onload event (e.g., `<iframe src="about:blank" onload="alert(document.domain)"></iframe>`) and save it. The payload persists in the database and executes when any user views or previews the post, including administrators. The attack requires authentication but no user interaction beyond viewing the post. As of August 31, 2026, the vulnerability remains unfixed with no vendor response after 90 days of responsible disclosure attempts.
Affected products
- SEOWriting SEOWriting through 1.12.5
Timeline
- 2026-09-02: disclosed
- 2026-08-31: other: Vendor unresponsive after 90 days of disclosure attempts; vulnerability remains unfixed