Threat Entry Updated 2026-05-20

CVE-2026-6391 - Sentence To Seo Plugin

The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the create_admin_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts and update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Sentence To Seo

CVE-2026-6391

MEDIUM CVSS 6.1 2026-05-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-22

CVE-2026-4142 - Sentence To Seo Plugin

The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Permanent keywords' field in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin reads user input via filter_input_array(INPUT_POST) which applies no HTML sanitization (FILTER_DEFAULT), stores it unsanitized to the WordPress options table via update_option(), and then outputs the stored value directly into a textarea element without any escaping using PHP short echo tags (). An attacker can break out of the…

PLUGIN Sentence To Seo

CVE-2026-4142

MEDIUM CVSS 4.4 2026-04-22

Risk Score

Open Full Technical Breakdown