Threats tagged 'ghsa-r9hf-x848-v6cc'

CVE-2026-11588 is a stored cross-site scripting (XSS) vulnerability in the EONSR AEO Agent WordPress plugin through version 3.7.9. The plugin fails to perform authorization checks on a REST API route and disables HTML sanitization before saving posts. This allows unauthenticated attackers to create published posts attributed to administrators containing arbitrary scripts that execute in visitors' browsers, including administrators. The vulnerability has a medium severity with a CVSS score of 6.1.