263 matches found
CVE-2024-4041
CVE-2024-4041 Yoast SEO /?page=%22%20onmouseover%3D%22alertdocument.domain%22%20x%3D%22 3. In the admin bar, open the Yoast menu and hover/click Get Yoast SEO Premium. 4. JavaScript executes from the injected event handler onmouseover, confirming reflected XSS...
WordPress Yoast SEO Premium plugin < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE vulnerability
Author+ Arbitrary .htaccess Directive Injection to RCE vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Yoast SEO Premium versions 27.6.1...
CVE-2026-10821
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
EUVD-2026-70033
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
CVE-2026-10821
Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...
CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
PT-2026-84717
Name of the Vulnerable Software and Affected Versions Yoast SEO Premium versions prior to 27.6.1 Description Insufficient sanitization of control characters from redirect origins occurs when file-based redirect mode is enabled. Users with Author-level access can reach the redirect-creation endpoi...
CVE-2026-10821: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
WordPress Yoast SEO - Full Path Disclosure Detection
WordPress Yoast SEO plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Yoast SEO plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...
Yoast SEO 16.7-17.2 - Information Disclosure Detection
Yoast SEO plugin 16.7 to 17.2 is susceptible to information disclosure, The plugin discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints, which can help an attacker identify other vulnerabilities or help during the exploitation of other identified...
CVE-2026-15425
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-48765
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15425
The CVE concerns the Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress (Yoast SEO) vulnerable to Stored Cross-Site Scripting via the Post Slug (post_name) feature. Affected versions: all up to and including 28.0. Root cause: insufficient input sanitization and ...
CVE-2026-15425
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15425: Improper Neutralization of Input During Web Page Generation
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Yoast SEO versions = 28.0...