Yoast vulnerabilities

27 vulnerabilities

Known vulnerabilities in Yoast products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.

Products

10 of 11
6.6MediumCVE-2018-19370wordpress · wordpress-seo +1 morewordpress wordpress-seoA Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.EPSS3.21%6.4MediumCVE-2021-31779yoast · yoast_seoyoast yoast_seoThe yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.EPSS0.47%5.4MediumCVE-2021-36788yoast · yoast_seoyoast yoast_seoThe yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.EPSS0.47%5.3MediumCVE-2021-25118unknown · yoast seo +2 moreYoast SEO 16.7-17.2 - Unauthenticated Full Path DisclosureThe Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.EPSS5.63%5.4MediumCVE-2021-24153unknown · yoast seo +2 moreYoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.EPSS1.11%8.8HighCVE-2015-2292wordpress · wordpress-seo +1 morewordpress wordpress-seoMultiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.EPSS5.79%7.5HighCVE-2015-2293wordpress · wordpress-seo +1 morewordpress wordpress-seoMultiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.EPSS1.52%4.3MediumCVE-2025-14481wordpress · wordpress-seo +1 moreYoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' ParameterThe Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to read sensitive SEO metadata from any post on the site via the 'post_id' parameter, including posts owned by other users, private posts, and draft posts.EPSS0.29%4.3MediumCVE-2014-9174wordpress · google-analytics-for-wordpress +1 morewordpress google-analytics-for-wordpressCross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Manually enter your UA code" (manual_ua_code_field) field in the General Settings.EPSS1.96%6.1MediumCVE-2012-6692wordpress · wordpress-seo +1 morewordpress wordpress-seoCross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.EPSS3.18%6.1MediumCVE-2017-16842wordpress · wordpress-seo +1 morewordpress wordpress-seoCross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.EPSS1.34%6.1MediumCVE-2017-20092unspecified · google analytics dashboard plugin +1 moreGoogle Analytics Dashboard Plugin cross site scritingA vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely.EPSS0.65%6.4MediumCVE-2024-4984wordpress · wordpress-seo +1 moreYoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.63%6.1MediumCVE-2024-4041wordpress · wordpress-seo +1 moreYoast SEO <= 22.5 - Reflected Cross-Site ScriptingThe Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 22.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.EPSS0.83%9.9CriticalCVE-2019-13478wordpress · wordpress-seo +1 morewordpress wordpress-seoThe Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.EPSS3.30%5.5MediumCVE-2019-25314wordpress · duplicate-post +1 moreDuplicate-Post 3.2.3 - Persistent Cross-Site ScriptingYoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.EPSS0.24%5.4MediumCVE-2026-1217wordpress · duplicate-post +1 moreYoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and OverwriteThe Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.EPSS0.18%6.4MediumCVE-2026-1293wordpress · wordpress-seo +1 moreYoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block AttributeThe Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schema` block attribute in all versions up to, and including, 26.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.22%5.1MediumCVE-2026-53739yoast · yoast duplicate postYoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_noticeYoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.EPSS0.15%5.4MediumCVE-2026-53740yoast · yoast duplicate postYoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish NoticeYoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.EPSS0.24%