CVE-2026-96564 is a stored cross-site scripting vulnerability (CWE-79) in the SEOPress – AI SEO Plugin & On-site SEO WordPress plugin by rainbowgeek. Versions up to and including 10.2 are affected due to improper neutralization of input during web page generation, specifically via the Author Display Name field. The vulnerability can be exploited when the 'Track Authors' custom dimension is enabled in Google Analytics 4 or Matomo settings, and an attacker can publish public singular content such as bbPress forum topics. This allows injection of arbitrary web scripts that execute in the context of users visiting the injected pages.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting affected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), indicating significant impact on confidentiality and integrity but no impact on availability. Exploitation requires specific plugin configuration and publishing privileges, limiting the attack surface.

No official patch or fix is currently documented. Users should check the vendor advisory for updates. Until a fix is available, disabling the 'Track Authors' custom dimension in Google Analytics 4 or Matomo settings and restricting the ability to publish public singular content can reduce exposure. Monitor vendor channels for an official update or patch.