CVE-2026-54868: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in FolioVision FV Simpler SEO

This vulnerability in FolioVision FV Simpler SEO (fv-all-in-one-seo-pack) allows an attacker with limited privileges to inject malicious scripts that are stored and later executed in the context of users visiting affected web pages. The flaw is due to improper input sanitization during web page generation. The affected versions include all releases from initial availability through 1.9.7. No known exploits are reported in the wild as of the publication date.

Successful exploitation could lead to partial compromise of confidentiality, integrity, and availability of the affected web application. Specifically, it may allow attackers to execute arbitrary scripts in the context of users, potentially leading to session hijacking, defacement, or other malicious actions. The impact is rated medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's communications for updates and apply patches once available. Until then, consider restricting user input and applying additional input validation or sanitization as a temporary measure.