{"affected":[{"defaultStatus":"unaffected","product":"SEOPress","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"10.4","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-108041","cwes":["CWE-79"],"description":"The SEOPress  WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress  WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/5776859a-d381-4e89-b263-4e22a74bfa83/"}],"kev":null,"metrics":[],"modifiedAt":1793772024705,"publishedAt":1793772024705,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/5776859a-d381-4e89-b263-4e22a74bfa83/"}],"remediation":[],"revision":"d5e76ab08ef0711b8cfbfdcbc4e7b0a3dc88ec41ea6a73f8ca6d68e8d464b3da","sources":[{"modifiedAt":1793772024705,"name":"CNA: WPScan","retrievedAt":1793776118786,"url":"https://www.cve.org/CVERecord?id=CVE-2026-108041"}],"ssvc":null,"status":"published","title":"SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings","updatedAt":1793776118786}