CVE-2026-66664
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO up to version 14.2.0, allowing an unauthenticated attacker to inject malicious scripts into pages.
Risk Assessment
An attacker can steal user data such as sessions or cookies, potentially leading to account takeover or malware distribution.
Recommendation
Update the SEO Plugin by Squirrly SEO to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in SEO Plugin by Squirrly SEO
See all- CVE-2026-66614High
Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
- CVE-2026-7624Medium
The SEO Plugin by Squirrly SEO for WordPress up to version 12.4.16 contains an authorization bypass vulnerability. Authenticated attackers with contributor-level access or higher can invoke privileged Squirrly cloud API operations, such as revoking Google Search Console and Google Analytics integrations, which are normally restricted to administrators with the sq_manage_settings capability.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.