CVE-2026-15425mediumCWE-79

CVE-2026-15425: medium-severity vulnerability in Yoast SEO – Advanced SEO with real-time…

Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

Published · Updated

Follow this CVE+ Monitor Yoast SEO – Advanced SEO with real-time guidance and built-in AI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.3%
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
yoast · Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Related CVEs — Yoast SEO – Advanced SEO with real-time…

In the same product, most dangerous first.

CVE-2024-4041MEDIUMYoast SEO <= 22.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-4984MEDIUMYoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-14481MEDIUMYoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' ParameterEPSS 0.3%CVE-2026-1293MEDIUMYoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block AttributeEPSS 0.2%CVE-2026-3427MEDIUMYoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block AttributeEPSS 0.2%