CVE-2023-40680

CVE-2023-40680 describes a stored XSS in WordPress Yoast SEO Plugin

CVE-2021-25118

CVE-2021-25118 affects Yoast SEO for WordPress, versions 16.7–17.2. The vulnerability enables information disclosure by exposing the full internal path of featured images in posts via the wp/v2/posts REST endpoints. This data exposure could help an attacker identify other vulnerabilities or assis...

CVE-2019-13478

The CVE-2019-13478 entry describes a vulnerability in the WordPress Yoast SEO plugin prior to 11.6-RC5 where unfiltered HTML in term descriptions is not properly restricted, enabling cross-site scripting. Affected software is the Yoast SEO plugin for WordPress (versions before 11.6-RC5). Impact, ...

CVE-2023-28775

CVE-2023-28775 affects Yoast SEO Premium (WordPress plugin) up to version 20.4. The issue is Missing Authorization / Broken Access Control allowing unauthenticated actions (Zapier API key reset). Patch 20.5 fixes it. Recommend upgrading to Yoast SEO Premium 20.5 or later and validating API key co...

CVE-2021-36788

The CVE-2021-36788 entry concerns the Yoast SEO extension for TYPO3, vulnerable before version 7.2.3 due to improper encoding of user input in HTML output, enabling Cross-Site Scripting. Exploitation details vary by report, but a back-end TYPO3 account is typically required to trigger the issue. ...

CVE-2018-19370

The CVE-2018-19370 entry concerns Yoast SEO (wordpress-seo) plugin for WordPress, specifically versions before 9.2.0. A race-condition in unzip_file (admin/import/class-import-settings.php) allows an SEO Manager to execute OS commands via a ZIP import. Public sources in the connected documents co...

CVE-2023-32300

CVE-2023-32300 affects WordPress Yoast SEO Local plugin versions ≤14.8. The vulnerability is unauthenticated reflected cross-site scripting (XSS) in Local input handling, with potential impact to confidentiality and integrity but not availability per the cited metrics. Remediation is to upgrade t...

CVE-2023-28785

CVE-2023-28785: A Stored XSS vulnerability affects WordPress Yoast SEO Local plugin versions up to 14.9. The issue is triggered by contributors or higher privileges and is addressed in version 15.0. Public details in Patchstack specify vulnerable versions

CVE-2021-31779

The CVE-2021-31779 issue affects the Yoast SEO extension for TYPO3, specifically versions prior to 7.2.1. A backend TYPO3 user could trigger server-side requests to arbitrary URLs due to insufficient restriction of analyzed URLs to domains managed by the site, enabling SSRF. The vulnerability is ...

CVE-2021-24153

Summary: CVE-2021-24153 affects the WordPress Yoast SEO plugin prior to 3.4.1. The vulnerability is a Stored Cross-Site Scripting (XSS) issue where built-in blacklist filters (e.g., parentheses, alert) were bypassed. Documents consistently describe this as an authenticated XSS risk. What’s affect...