Vulnerabilities / GEO Plugin by Squirrly SEO / WPSEC-2026-0427
GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via sq_keyword Custom Field
Medium 6.4
CWE-79Fixed in 14.2.7
- ID
- WPSEC-2026-0427
- Plugin
- GEO Plugin by Squirrly SEO (squirrly-seo)
- Affected
- all versions before 14.2.7
- Remediation
- Update to 14.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GEO Plugin by Squirrly SEO on WPSec AttackSurface
- Fix released
- Published
Description
The GEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sq_keyword' post custom field in all versions up to, and including, 14.2.6. This is due to the focus keyword being output without escaping in the plugin's column of the admin posts list on sites connected to Squirrly Cloud. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user views the posts list.
References
- https://wpsec.com/vuln/WPSEC-2026-0427/
- https://plugins.svn.wordpress.org/squirrly-seo/tags/14.2.7/
- https://wordpress.org/plugins/squirrly-seo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS