CVE-2026-1667
Deferred Deferred - Pending Action

Arbitrary Post Creation and Stored XSS in Squirrly SEO WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to create arbitrary posts, and, if the Advanced Custom Fields plugin is installed and activated, inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-1667
EUVD
EUVD-2026-42949

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
squirrly seo_plugin to 14.0.0 (inc)
advanced_custom_fields advanced_custom_fields_plugin *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The SEO Plugin by Squirrly SEO for WordPress has a vulnerability in all versions up to and including 14.0.0. This vulnerability arises from a leaked API token combined with insufficient input sanitization and output escaping.

Because of this, unauthenticated attackers can create arbitrary posts on the affected WordPress site. Additionally, if the Advanced Custom Fields plugin is installed and activated, attackers can inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the injected page, leading to stored cross-site scripting (XSS).

Impact Analysis

This vulnerability allows attackers to create arbitrary posts without authentication, which can lead to unauthorized content being published on your website.

If the Advanced Custom Fields plugin is active, attackers can also inject malicious scripts that execute in users' browsers when they visit the compromised pages. This can lead to theft of user data, session hijacking, or other malicious activities.

The CVSS score of 7.2 indicates a high severity, meaning the vulnerability poses a significant risk to confidentiality and integrity of the affected system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart