CVE-2026-101357Published
SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-101357 · Microsoft / collected KEV context
cve-program · CVE-2026-101357
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e88ec391-8d1b-4544-a7d0-0ac156c91ba5?source=cve
- https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.2/inc/functions/options-matomo.php#L193
- https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.2/inc/functions/options-matomo.php#L197
- https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.2/src/Actions/Api/Options/AnalyticsSettings.php#L90
- https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.2/inc/admin/sanitize/Sanitize.php#L183
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3722789%40wp-seopress&new=3722789%40wp-seopress
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.