CVE-2026-1667: Squirrly SEO Plugin Arbitrary Post Creation & Stored XSS

Technical summary

CVE-2026-1667 stems from insufficient protection of an API token within the Squirrly SEO plugin, combined with inadequate input sanitization and output escaping mechanisms. The token leak enables unauthenticated threat actors to instantiate post creation via the plugin's API surface. When Advanced Custom Fields is present, the same vulnerability allows stored XSS injection through unescaped field values, executing arbitrary JavaScript in the browser context of any user visiting the compromised page. The CVSS 3.1 score of 7.2 (HIGH) reflects the network-based attack vector, low complexity, absence of privilege requirements, and cross-site impact scope.

Business impact

Organizations running Squirrly SEO face risk of unauthorized content injection, brand damage, and potential SEO poisoning through spam or malicious posts. The stored XSS component poses a direct threat to user data if Advanced Custom Fields is deployed—visitor sessions, cookies, and sensitive form submissions may be compromised. Remediation delays expose sites to sustained secondary attacks, particularly if compromised pages are indexed by search engines.

Affected systems

WordPress installations using the Squirrly SEO plugin version 14.0.0 and earlier are affected. Risk is amplified for sites that also have Advanced Custom Fields installed and activated. All WordPress hosting environments—shared, managed, or self-hosted—are in scope.

Exploitability

Exploitability is high: the vulnerability requires no authentication, no user interaction (for post creation), and presents a clear network-accessible attack surface. Automated tools can rapidly enumerate and exploit affected instances at scale. Post-exploitation impact escalates if ACF is present, as stored XSS enables persistent, client-side attacks against end users.

Remediation

Update the Squirrly SEO plugin immediately to a version that addresses the API token exposure and implements proper input sanitization and output escaping. Verify the fix version against the official Squirrly plugin changelog and WordPress repository. As an interim containment measure, disable the plugin if an update is unavailable, audit for unauthorized posts created after the plugin installation date, and review database logs for anomalous post creation activity.

Patch guidance

Check the WordPress Plugin Directory or Squirrly's official advisory for the patched release version. Apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > Update) once available. After patching, audit post revisions and metadata for indicators of compromise. If using Advanced Custom Fields alongside Squirrly SEO, prioritize patching and verify both plugins are on current versions before re-enabling full functionality.

Detection guidance

Monitor WordPress post creation activity for posts created with timestamps matching periods of known plugin vulnerability or by unexpected user accounts. Inspect post meta and custom field values for suspicious JavaScript or base64-encoded payloads using SIEM or log analysis. Check web server access logs for requests to the Squirrly SEO plugin's API endpoints bearing suspicious parameters or abnormal query patterns. Scan published pages for inline script tags or event handlers that lack corresponding editorial intent.

Why prioritize this

Assign this vulnerability critical priority. The combination of unauthenticated post creation, stored XSS potential (when ACF is present), and ease of exploitation justifies immediate action. The lack of KEV (Known Exploited Vulnerability) status does not diminish urgency—the simplicity of the vulnerability makes active exploitation likely. Organizations should treat this as a 24–48-hour patching window.

Risk score, explained

The CVSS 7.2 (HIGH) reflects a network-adjacent threat with low complexity and no privilege gate. While the base impact is limited to confidentiality and integrity of published content, the stored XSS component and cross-site scope multiplier elevate practical risk substantially for WordPress ecosystems hosting customer-facing or data-collection forms.

Frequently asked questions