CVE-2024-4041

🗓️ 09 May 2024 20:03:25Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 165 Views🌐 WEB

The Yoast SEO plugin for WordPress has Reflected Cross-Site Scripting vulnerabilit

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2024-4041	7 May 202412:31	–	circl
CNNVD	WordPress plugin Yoast SEO 安全漏洞	14 May 202400:00	–	cnnvd
Cvelist	CVE-2024-4041 Yoast SEO <= 22.5 - Reflected Cross-Site Scripting	9 May 202420:03	–	cvelist
EUVD	EUVD-2024-32606	3 Oct 202520:07	–	euvd
GithubExploit	Exploit for CVE-2024-4041	18 Feb 202617:11	–	githubexploit
NVD	CVE-2024-4041	14 May 202415:42	–	nvd
OpenVAS	WordPress Yoast SEO Plugin < 22.6 XSS Vulnerability	20 Feb 202500:00	–	openvas
Packet Storm	📄 Yoast SEO 22.5 Cross Site Scripting	19 Feb 202600:00	–	packetstorm
Patchstack	WordPress Yoast SEO plugin <= 22.5 - Reflected Cross-Site Scripting vulnerability	6 May 202416:07	–	patchstack
Patchstack	WordPress Yoast SEO Plugin <= 22.5 is vulnerable to Cross Site Scripting (XSS)	6 May 202400:00	–	patchstack

Vulners

Node

yoast yoast_seo_advanced_seo_with_real-time_guidance_and_built-in_aiRange≤22.5wordpress

[
  {
    "vendor": "yoast",
    "product": "Yoast SEO – Advanced SEO with real-time guidance and built-in AI",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "22.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/4e04b161-3cd0-454d-869c-56f42bd8afb0
plugins	www.plugins.trac.wordpress.org/browser/wordpress-seo/trunk/inc/class-wpseo-admin-bar-menu.php
plugins	www.plugins.trac.wordpress.org/browser/wordpress-seo/trunk/src/helpers/short-link-helper.php
plugins	www.plugins.trac.wordpress.org/browser/wordpress-seo/trunk/inc/class-wpseo-shortlinker.php
plugins	www.plugins.trac.wordpress.org/changeset/3078555/wordpress-seo/trunk
plugins	www.plugins.trac.wordpress.org/browser/wordpress-seo/trunk/src/helpers/short-link-helper.php

Parameter	Position	Path	Description	CWE
page	query param	/?page=%22%20onmouseover%3D%22alert(document.domain)%22%20x%3D%22	Reflected XSS via URL parameter in Yoast SEO <= 22.5; unsanitized input reflected in page leading to script execution when user visits the crafted URL.	CWE-79

15 Apr 2026 00:35Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.1

EPSS0.05515

SSVC

CWE-79