Yoast
19 CVEs across 11 Yoast products. Browse Yoast vulnerabilities, severities, and proof-of-concept exploits.
Yoast products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15425 | Medium | 6.4 | 2026-07-25 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name… |
CVE-2026-53740 | Medium | 5.4 | 2026-06-10 | Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a rep… |
CVE-2026-53739 | Medium | 4.3 | 2026-06-10 | Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or c… |
CVE-2025-14481 | Medium | 4.3 | 2026-05-27 | The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient a… |
CVE-2026-3427 | Medium | 6.4 | 2026-03-22 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `jsonText` b… |
CVE-2026-1217 | Medium | 5.4 | 2026-03-18 | The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_han… |
CVE-2019-25314 | Medium | 5.5 | 2026-02-11 | Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malici… |
CVE-2026-1293 | Medium | 6.4 | 2026-02-06 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schem… |
CVE-2023-28775 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4. |
CVE-2024-4984 | Medium | 6.4 | 2024-05-16 | The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ author meta in all versions up to, and including, 22.6 d… |
CVE-2024-4041 | Medium | 6.1 | 2024-05-14 | The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 22.5 due to insufficient inpu… |
CVE-2023-40680 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects… |
CVE-2023-28780 | Medium | 6.5 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8. |
CVE-2023-32300 | High | 7.1 | 2023-08-23 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions. |
CVE-2023-28785 | Medium | 6.5 | 2023-05-28 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions. |
CVE-2017-20092 | Low | 3.5 | 2022-06-24 | A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The… |
CVE-2021-25118 | Medium | 5.3 | 2022-02-28 | The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints… |
CVE-2021-36788 | Medium | 5.4 | 2021-08-13 | The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS. |
CVE-2021-31779 | Medium | 6.4 | 2021-04-28 | The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account. |
CVE-2021-24153 | Medium | 5.4 | 2021-04-05 | A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blac… |
CVE-2019-13478 | Critical | 9.8 | 2019-07-09 | The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions. |
CVE-2018-19370 | Medium | 6.6 | 2018-11-28 | A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allow… |
CVE-2017-16842 | Medium | 4.8 | 2017-11-16 | Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote at… |
CVE-2012-6692 | | 2015-06-17 | Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to injec… | |
CVE-2015-2293 | | 2015-03-17 | Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x b… | |
CVE-2015-2292 | | 2015-03-17 | Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7… | |
CVE-2014-9174 | | 2014-12-02 | Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote atta… |