CVE-2026-1667

HIGH 7.2

SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to create arbitrary posts, and, if the Advanced Custom Fields plugin is installed and activated, inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE	CWE-862
Vendor	cifi
Product	geo plugin by squirrly seo
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for cifi geo plugin by squirrly seo

Be the first to know when new high vulnerabilities affecting cifi geo plugin by squirrly seo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

cifi / GEO Plugin by Squirrly SEO

0 ≤ 14.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/aebdd464-10b9-4d43-bf38-f0e8ae25625f?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?reponame=&new=3586051%40squirrly-seo&old=3474256%40squirrly-seo

Credits

Osvaldo Noe Gonzalez Del Rio (Os)