CVE-2026-4142

VULNERABILITY SUMMARY CVE-2026-4142 is a stored cross-site scripting (XSS) vulnerability in the Sentence To SEO plugin for WordPress affecting all versions up to and including 1.0. The vulnerability exists in the "Permanent keywords" field due to insufficient input sanitization and improper output escaping, allowing authenticated administrators to inject arbitrary HTML and JavaScript code into the plugin's settings page. The vulnerability carries a CVSS 3.1 score of 4.4 (medium severity) with a network-based attack vector and high attack complexity. Exploitation requires high-level privileges (administrator access) and produces no user interaction requirement. The potential impact is limited to low-level confidentiality and integrity compromises affecting the plugin settings scope. The exploit method involves breaking out of a textarea element using closing tags to inject malicious scripts that execute when users access the plugin settings. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00019 indicates minimal community exploitation activity, and the plugin remains on the inactive hot list status. No public exploit code or significant community attention has been documented for this vulnerability at present.