EUVD-2026-48765
GHSA-6qx8-mxxj-98fc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Author credentials required (PR:L); a victim must visit the page (UI:R); scope changes to victim browser (S:C); no server-side availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Yoast SEO - Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
AnalysisAI
Stored Cross-Site Scripting in the Yoast SEO WordPress plugin (all versions through 28.0) allows authenticated attackers holding author-level accounts or higher to inject persistent JavaScript via a crafted post slug (post_name field) that executes in the browsers of any user who later visits the affected page. The vulnerability traces to insufficient sanitization in the bulk-editor list table (class-bulk-editor-list-table.php, lines 898-900) combined with get_permalink() embedding the stored percent-encoded post_name in generated URLs without adequate escaping. No confirmed active exploitation (no CISA KEV listing) and no public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C) reflects cross-user browser impact consistent with a medium-priority persistent XSS.
Technical ContextAI
The vulnerability resides in Yoast SEO's bulk editor admin interface, specifically the WordPress class-bulk-editor-list-table.php file responsible for rendering post management tables. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the plugin stores attacker-controlled percent-encoded characters in the WordPress post_name (slug) database column without applying wp_kses or equivalent output escaping. When WordPress's get_permalink() constructs a URL embedding that slug, and the Yoast bulk editor or front-end page subsequently renders the resulting hyperlink, the unescaped payload is delivered to the victim's browser. The attack chain specifically depends on WordPress pretty permalinks (e.g., /%postname%/) being configured, because plain ?p=ID permalink structures do not embed the slug in the URL and thus do not trigger the injection. Affected CPE: the Yoast SEO plugin for WordPress, all releases from 0 through 28.0 inclusive.
RemediationAI
Upgrade the Yoast SEO plugin to version 28.1 or later; the upstream fix is documented in the Trac changeset between tags/28.0 and tags/28.1 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fwordpress-seo/tags/28.0&new_path=%2Fwordpress-seo/tags/28.1) and corresponds to a specific patch in class-bulk-editor-list-table.php (https://plugins.trac.wordpress.org/changeset/3598937/wordpress-seo/trunk/admin/class-bulk-editor-list-table.php). The patched version is 28.1 based on the changeset path - this should be independently verified against the WordPress.org plugin changelog before deployment. As a compensating control while patching is pending, restrict WordPress author-level role assignment to fully trusted users and audit existing accounts with author or higher privileges. Disabling pretty permalinks would technically break the exploit chain but has significant SEO and usability trade-offs and is not recommended as a standing workaround. Web Application Firewall rules targeting percent-encoded XSS payloads in post slug fields (as offered by Wordfence itself) can provide a detection layer without disrupting site function.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today