CVE-2026-85305
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.
Risk Assessment
An attacker can exploit SSRF to scan internal network, read files, or attack other systems, potentially leading to infrastructure compromise.
Recommendation
Update the SEOPress plugin to the latest version. Restrict access to features that could be used for SSRF.
Other vulnerabilities in SEOPress
See all- CVE-2026-96564High
The SEOPress plugin for WordPress is vulnerable to stored cross-site scripting via author display name in versions up to and including 10.2. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content.
- CVE-2026-101357Medium
The SEOPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS