Atomic Edge analysis of CVE-2026-4142 (metadata-based): The Sentence To SEO plugin for WordPress contains a stored cross-site scripting vulnerability in all versions up to and including 1.0. An authenticated attacker with administrator-level access can inject arbitrary HTML and JavaScript through the ‘Permanent keywords’ field. The vulnerability arises because the plugin uses filter_input_array(INPUT_POST) with FILTER_DEFAULT, which applies no sanitization. The unsanitized input is stored via update_option() in the options table and later output directly into a textarea element using PHP short echo tags () without escaping. This allows an attacker to break out of the textarea by injecting a closing tag. Atomic Edge analysis confirms the root cause based on the CWE-79 classification and the explicit description from the CVE metadata, though no source code diff is available for independent verification.
The root cause is the complete absence of input sanitization and output escaping. The plugin reads user input via filter_input_array(INPUT_POST, array(‘field_name’ => FILTER_DEFAULT)). FILTER_DEFAULT applies no sanitization, leaving the raw input intact. The plugin then stores this unsanitized value into the WordPress options table using update_option(). When displaying the settings page, the plugin outputs the stored value directly into a textarea element with PHP short echo tags () without any escaping function like esc_textarea() or esc_html(). An attacker can include a closing tag in the value, which prematurely closes the textarea element, allowing arbitrary HTML and JavaScript to be injected into the page. Atomic Edge infers these code patterns from the CWE classification and the CVE description; they are not confirmed from source code because the plugin is not available for download.
Exploitation requires administrator-level access to the WordPress admin panel. The attacker navigates to the plugin’s settings page, likely under the admin menu for ‘Sentence To SEO’. The vulnerable field is the ‘Permanent keywords’ textarea. The attacker submits a payload like alert(‘XSS’)