CVE-2026-15425

MediumCVSS 6.4

Published: 25/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The Yoast SEO plugin for WordPress up to version 28.0 is vulnerable to stored XSS via the Post Slug (post_name) field. Authenticated attackers with author-level access or higher can inject malicious scripts that execute when a user visits the affected page. Pretty permalinks must be enabled.

Risk Assessment

Attackers can steal user sessions, redirect to malicious sites, or modify content, compromising data confidentiality and integrity.

Recommendation

Update the Yoast SEO plugin to the latest version. If not possible, consider disabling pretty permalinks or restricting author-level permissions.

Other vulnerabilities in Yoast SEO

CVE-2025-14481Medium
The Yoast SEO plugin for WordPress up to version 26.5 is vulnerable to Insecure Direct Object References (IDOR) in the Meta Search REST API endpoint. It lacks proper authorization checks to verify post ownership, allowing authenticated attackers with Contributor-level access or higher to read sensitive SEO metadata from any post on the site, including other users' posts, private posts, and drafts.

Original NVD description (English source)

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS