WordPress plugin
Yoast SEO – Advanced SEO with real-time guidance and built-in AI security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium18
- Low0
All Yoast SEO – Advanced SEO with real-time guidance and built-in AI vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name) ≤28.0Update to 28.1 | CVE-2026-15425 | |
| Medium4.3 | Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter ≤26.5Update to 26.6 | CVE-2025-14481 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute ≤27.1.1Update to 27.2 | CVE-2026-3427 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute ≤26.8Update to 26.9 | CVE-2026-1293 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤22.6Update to 22.7 | CVE-2024-4984 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤22.5Update to 22.6 | CVE-2024-4041 | |
| Medium5.5 | Authenticated (Seo Manager+) Stored Cross-Site Scripting ≤21.0Update to 21.1 | CVE-2023-40680 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤20.2Update to 20.2.1 | — | |
| Medium5.3 | Full Path Disclosure <17.3Update to 17.3 | CVE-2021-25118 | |
| Medium6.4 | Authenticated Stored Cross Site Scripting ≤11.5Update to 11.6-RC5 | CVE-2019-13478 | |
| Medium6.6 | Race Condition to Remote Code Execution ≤9.1.0Update to 9.2.0 | CVE-2018-19370 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤5.7.1Update to 5.8.0 | CVE-2017-16842 | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting <3.4.1Update to 3.4.1 | CVE-2021-24153 | |
| Medium4.7 | Cross-Site Scripting ≤3.2.5Update to 3.3.0 | — | |
| Medium5.3 | Sensitive Data Exposure ≤3.2.4Update to 3.2.5 | — | |
| Medium6.1 | Reflected Cross-Site Scripting <2.1Update to 2.1 | — | |
| High8.8 | Blind SQL Injection ≤1.7.3Update to 1.5.7 or 1.6.4 or 1.7.4 | CVE-2015-2292 | |
| High7.5 | Cross-Site Request Forgery ≤1.7.3.3Update to 1.5.7 or 1.6.4 or 1.7.4 | CVE-2015-2293 | |
| Medium6.5 | Missing Authorization ≤1.4.6Update to 1.4.7 | — | |
| Medium6.1 | Cross Site Scripting via post_title parameter ≤2.1.1Update to 2.2 | CVE-2012-6692 |
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
≤28.0Update to 28.1
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter
≤26.5Update to 26.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute
≤27.1.1Update to 27.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute
≤26.8Update to 26.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤22.6Update to 22.7
- Medium6.1Reflected Cross-Site Scripting
≤22.5Update to 22.6
- Medium5.5Authenticated (Seo Manager+) Stored Cross-Site Scripting
≤21.0Update to 21.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤20.2Update to 20.2.1
- Medium5.3Full Path Disclosure
<17.3Update to 17.3
- Medium6.4Authenticated Stored Cross Site Scripting
≤11.5Update to 11.6-RC5
- Medium6.6Race Condition to Remote Code Execution
≤9.1.0Update to 9.2.0
- Medium6.1Reflected Cross-Site Scripting
≤5.7.1Update to 5.8.0
- Medium5.4Authenticated Stored Cross-Site Scripting
<3.4.1Update to 3.4.1
- Medium4.7Cross-Site Scripting
≤3.2.5Update to 3.3.0
- Medium5.3Sensitive Data Exposure
≤3.2.4Update to 3.2.5
- Medium6.1Reflected Cross-Site Scripting
<2.1Update to 2.1
- High8.8Blind SQL Injection
≤1.7.3Update to 1.5.7 or 1.6.4 or 1.7.4
- High7.5Cross-Site Request Forgery
≤1.7.3.3Update to 1.5.7 or 1.6.4 or 1.7.4
- Medium6.5Missing Authorization
≤1.4.6Update to 1.4.7
- Medium6.1Cross Site Scripting via post_title parameter
≤2.1.1Update to 2.2
Yoast SEO – Advanced SEO with real-time guidance and built-in AI: common questions
Does Yoast SEO – Advanced SEO with real-time guidance and built-in AI have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in Yoast SEO – Advanced SEO with real-time guidance and built-in AI: 2 high, 18 medium. None are known to affect version null.
How do I check which version of Yoast SEO – Advanced SEO with real-time guidance and built-in AI I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Yoast SEO – Advanced SEO with real-time guidance and built-in AI vulnerability?
CVE-2026-15425, published Jul 24, 2026: Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name). Severity: Medium (CVSS 6.4).
Is any Yoast SEO – Advanced SEO with real-time guidance and built-in AI vulnerability listed in CISA KEV?
No. None of the known Yoast SEO – Advanced SEO with real-time guidance and built-in AI vulnerabilities is currently listed in the CISA KEV catalog.