CVE-2026-66614
HighCVSS 7.1Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Risk Assessment
Risk of user data theft, session hijacking, or malware distribution through the injected script.
Recommendation
Update the SEO Plugin by Squirrly SEO plugin to the latest version that includes a fix eliminating the XSS vulnerability.
Other vulnerabilities in SEO Plugin by Squirrly SEO
See all- CVE-2026-66664High
Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO up to version 14.2.0, allowing an unauthenticated attacker to inject malicious scripts into pages.
- CVE-2026-7624Medium
The SEO Plugin by Squirrly SEO for WordPress up to version 12.4.16 contains an authorization bypass vulnerability. Authenticated attackers with contributor-level access or higher can invoke privileged Squirrly cloud API operations, such as revoking Google Search Console and Google Analytics integrations, which are normally restricted to administrators with the sq_manage_settings capability.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.