CVE-2026-94076
HighCVSS 8.8Summary
The SEO Plugin by Squirrly SEO in versions <= 14.2.5 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.
Risk Assessment
A user with Contributor privileges can inject a malicious PHP object, potentially leading to remote code execution or site takeover.
Recommendation
Update the SEO Plugin by Squirrly SEO to a version higher than 14.2.5. Consider temporarily restricting Contributor privileges.
Other vulnerabilities in SEO Plugin by Squirrly SEO
See all- CVE-2026-66614High
Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
- CVE-2026-66664High
Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO up to version 14.2.0, allowing an unauthenticated attacker to inject malicious scripts into pages.
- CVE-2026-7624Medium
The SEO Plugin by Squirrly SEO for WordPress up to version 12.4.16 contains an authorization bypass vulnerability. Authenticated attackers with contributor-level access or higher can invoke privileged Squirrly cloud API operations, such as revoking Google Search Console and Google Analytics integrations, which are normally restricted to administrators with the sq_manage_settings capability.
Original NVD description (English source)
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS