CVE-2026-11588
Received Received - Intake

EONSR AEO Agent WordPress Plugin Stored Cross-Site Scripting

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description
The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts that execute in the browser of any visitor, including administrators (Stored XSS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-11588
EUVD
EUVD-2026-53728

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the EONSR AEO Agent WordPress plugin versions 3.7.9 and below. The plugin fails to perform authorization checks on a REST API route and disables HTML sanitization before saving posts. This allows attackers to create administrator-attributed published posts containing arbitrary web scripts without authentication.

Detection Guidance

Check if the EONSR AEO Agent WordPress plugin version 3.7.9 or below is installed. Look for unauthorized posts created by unknown users, especially those with administrator attribution. Inspect REST API logs for suspicious activity on the vulnerable endpoint.

Impact Analysis

Attackers can inject malicious scripts into posts that execute in the browsers of any visitors, including administrators. This can lead to unauthorized actions, data theft, or further compromise of the WordPress site. The impact includes potential loss of control over the site and exposure of sensitive information.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. Unauthorized script execution may expose personal or health information, resulting in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately update the EONSR AEO Agent WordPress plugin to the latest version. If an update is unavailable, consider disabling the plugin until a patch is released. Review all posts for unauthorized changes and remove any suspicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11588. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart