CVE-2026-53608: @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

The @apostrophecms/seo package injects the Google Analytics Tracking ID (seoGoogleTrackingId) and Google Tag Manager ID (seoGoogleTagManager) directly into <script> tag bodies using JavaScript template literals without any sanitization or validation.

Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site.