PT-2026-34298 · WordPress · Sentence To Seo

Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-4142

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sentence To SEO versions prior to 1.1

Description The Sentence To SEO plugin for WordPress contains a Stored Cross-Site Scripting issue. The problem occurs because the plugin fails to properly sanitize input and escape output for the 'Permanent keywords' field. Specifically, user input is processed via the filter input array(INPUT POST) function without HTML sanitization and stored in the WordPress options table using update option(). The stored value is then rendered in a textarea element using PHP short echo tags without escaping. This allows authenticated attackers with administrator-level access or higher to inject arbitrary HTML or JavaScript by using a closing tag, which executes when a user visits the plugin settings page.

Recommendations Update the plugin to a version later than 1.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4142

Affected Products

Sentence To Seo

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2026-4142 · Security Note
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/tags/1.0/index.php#L50 · Note
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/tags/1.0/index.php#L81 · Note
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/tags/1.0/index.php#L87 · Note
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/tags/1.0/index.php#L262 · Note
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/trunk/index.php#L262 · Note
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/trunk/index.php#L81 · Note
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/trunk/index.php#L87 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7d11b2db-d097-433f-923c-f49ef2951c0e?source=cve · Note
• https://twitter.com/CVEnew/status/2047428120333230397 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/tags/1.0/index.php#L75 · Note
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/trunk/index.php#L75 · Note
• https://twitter.com/VulmonFeeds/status/2046927709691867557 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sentence-to-seo/trunk/index.php#L50 · Note