Yoast SEO CVE-2026-15425

Exploitation requires the attacker to hold an authenticated WordPress account at author level or higher (editor, administrator). The target site must have pretty permalinks enabled (Settings > Permalinks set to any structure other than 'Plain'), because the exploit depends on get_permalink() embedding the stored post_name in the generated URL. Yoast SEO plugin must be installed and active on the site. A victim user must access the URL of the injected post or page for the stored script to execute in their browser. Exploitation is limited by: (1) mandatory authenticated author-level access - unauthenticated or subscriber-level attackers cannot trigger this; (2) the pretty permalinks configuration dependency (non-default on a brand-new WordPress install but extremely common in production deployments); (3) the need for a victim to actually visit the affected page. There is no evidence of exploitation against default WordPress configurations by unauthenticated attackers.

The CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) accurately conveys medium severity: network-reachable, low complexity, but gated on author-level credentials (PR:L). The scope change (S:C) reflects that successful exploitation crosses a trust boundary from the WordPress application context to victims' browsers. EPSS data was not provided in the input; without it, probabilistic exploitation likelihood cannot be quantified, but the absence of a KEV listing and public POC code depresses real-world urgency. The author-privilege prerequisite is a meaningful limiting factor - mass exploitation targeting WordPress sites at scale is constrained by the need to first obtain (or already hold) a content-creator account. However, sites where author registration is open, or where contributor accounts are broadly distributed among staff, face higher realistic risk. The pretty-permalinks dependency is practically negligible as a barrier, since the vast majority of WordPress deployments enable pretty permalinks. Overall: a legitimate medium-priority finding requiring timely patching, not an emergency, given no confirmed active exploitation.

An attacker who holds an author account on a targeted WordPress site - obtained via credential theft, phishing, or open registration - creates or edits a post and sets its slug to a percent-encoded XSS payload. Once the post is published and pretty permalinks are enabled, any administrator, editor, or site visitor who navigates to the post's URL has the script execute silently in their browser, potentially stealing session cookies or performing actions on behalf of the victim. No public proof-of-concept exploit code has been identified at time of analysis, but the vulnerability class is well-understood and the injection point is straightforward to discover from the referenced Trac source.