CVE-2026-4142 is a stored cross-site scripting vulnerability in the eazyserver Sentence To SEO WordPress plugin. The issue arises because user input from the 'Permanent keywords' field is read without HTML sanitization, stored unsanitized in the WordPress options table, and then output directly into a textarea element without escaping. This allows an attacker with administrator-level access to inject malicious scripts by breaking out of the textarea element, which execute when the plugin settings page is accessed.

An attacker with administrator privileges can inject arbitrary scripts that execute in the context of the plugin's settings page. This can lead to limited confidentiality and integrity impact, such as executing malicious JavaScript in the browser of users who access the settings page. The CVSS score of 4.4 reflects a medium severity with network attack vector, high attack complexity, and required privileges.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict administrator access to trusted users only and avoid visiting the plugin's settings page unnecessarily. Consider disabling or removing the plugin if possible to mitigate risk.