Yoast SEO Breadcrumb Shortcode CVE-2026-57764

Exploitation requires the attacker to possess a valid WordPress Contributor-level account (or higher) on the targeted site - this is confirmed by the PR:L CVSS metric. The Surbma Yoast SEO Breadcrumb Shortcode plugin must be installed and active (version <= 1.2). Victim interaction is required (UI:R): a user with sufficient privileges, most meaningfully a site administrator, must load or preview the page containing the injected shortcode. Exploitation is limited by: (1) the need for a pre-existing authenticated contributor account - unauthenticated or subscriber-level access is insufficient; (2) the requirement for an admin or editor to view the poisoned content, introducing a time delay and detection opportunity; and (3) the plugin being installed - sites not using this specific plugin are unaffected regardless of Yoast SEO presence.

The CVSS base score of 6.5 (Medium) is supported by the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The PR:L metric is the most important limiting factor: exploitation requires the attacker to already hold a Contributor-level WordPress account, which substantially narrows the realistic attack surface compared to an unauthenticated flaw. UI:R further constrains exploitation - a victim (typically an administrator) must view the page containing the malicious shortcode. The S:C scope change elevates practical impact: successful XSS can lead to session theft, admin account takeover, or malicious plugin/code injection, all of which exceed what the C:L/I:L/A:L component scores imply in isolation. No EPSS data was provided, no KEV listing exists, and no public proof-of-concept has been identified, suggesting this has not seen widespread exploitation. The A:L metric in the vendor-supplied vector is questionable for a pure XSS flaw - availability impact via XSS is atypical and not independently confirmed. Real-world priority is moderate: sites that allow untrusted contributors pose meaningful risk, while sites with a fully trusted contributor base have minimal exposure.

An attacker who has registered or compromised a Contributor account on the target WordPress site creates or edits a post that embeds a malicious JavaScript payload within a breadcrumb shortcode attribute. When a site administrator previews or publishes that post, the unescaped script executes in the admin's browser, potentially stealing the admin's session cookie or silently creating a new administrator account for persistent access.