WordPress Yoast SEO Premium Plugin 25.7-25.9 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: Yoast SEO Premium<\/p>
Fixed in version 26.0 <\/p>
Affected Version 25.7-25.9<\/p>
CVE: CVE-2025-11241<\/p>","date":"2025-10-03"},{"id":"89566d9ae1da0c18964f9798dbc13bdb7a04f885","name":"Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wordpress-seo-premium\/yoast-seo-premium-257-259-authenticated-contributor-stored-cross-site-scripting","description":"The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.","date":"2025-10-02"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"6.4","severity":"m","exploitable":"3.1","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"6.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"3.1","impact":"2.7"},"cwe":[{"cwe":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as \"<\", \">\", and \"&\" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"144a1a21977294630d674233593d894b453d6c3b3115a7a0ed76ef9398f9802f","name":"Yoast SEO Premium [wordpress-seo-premium] < 26.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"26.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-40722","name":"CVE-2026-40722","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-40722","description":"[en] Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Yoast SEO Premium: from n\/a through 26.6.","date":"2026-06-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"n","i":"l","a":"l","score":"5.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:N\/I:L\/A:L","score":"5.5","severity":"medium","av":"network","ac":"low","pr":"high","ui":"none","s":"changed","c":"none","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"959c9f212cc59a7f8388832d00e244ca64691d074ca7b2be5889e49d9cde8412","name":"Yoast SEO Premium [wordpress-seo-premium] < 27.6.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"27.6.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-10821","name":"CVE-2026-10821","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-10821","description":"[en] The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.","date":"2026-09-02"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"h","pr":"h","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"6.6","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"6.6","severity":"medium","av":"network","ac":"high","pr":"high","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","description":"The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}}]},"updated":"1788501918"}