The EONSR AEO Agent WordPress plugin versions up to 3.7.9 contain a stored XSS vulnerability (CWE-79) due to missing authorization checks on a REST API route and disabled HTML sanitization before saving posts. This flaw enables unauthenticated attackers to publish posts with embedded malicious scripts that execute in the context of any visitor's browser, including administrators. The vulnerability is tracked as CVE-2026-11588 with a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

An unauthenticated attacker can exploit this vulnerability to inject and store malicious scripts in posts that appear to be authored by administrators. These scripts execute in the browsers of any visitors who view the posts, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API routes if possible and monitor for suspicious post creation activity. Avoid visiting or sharing posts from untrusted sources. Follow vendor updates closely for an official fix or temporary mitigation.