Yoast Seo Advanced Seo With Real Time Guidance And Built In Ai EUVD-2026-14273

While the CVSS score of 6.4 reflects a Medium severity rating, several factors must be weighed to determine actual exploitability and risk. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates this is a network-accessible vulnerability with low complexity, but critically requires Privilege Level: Low (authenticated access as a Contributor). This significantly restricts the threat landscape compared to unauthenticated XSS vulnerabilities, as it assumes an attacker has legitimate WordPress account credentials or the organization has compromised contributor accounts. The vulnerability crosses trust boundaries (S:C for Scope Changed), meaning injected scripts can affect other users and site administrators, elevating the practical impact beyond a single account. No evidence of active exploitation in the wild or public POC code is currently documented, and the availability of multiple code references (changeset 3475308, GitHub PR #23035) suggests patches were implemented. Given the storage requirement for Yoast SEO blocks and the need for authenticated access, this poses a realistic threat primarily to organizations with loose contributor access controls or internal threats. The EPSS probability would likely moderate at 50-65% due to the authentication barrier, making this a meaningful but not critical priority compared to unauthenticated vulnerabilities; however, for high-traffic WordPress sites with many contributors, the risk escalates.

An authenticated WordPress contributor (either legitimate but malicious, or an account compromised via credential theft) with access to the page editor navigates to a page containing a Yoast SEO block and edits the jsonText attribute to inject a payload such as {"onClick":"alert('XSS')"} or similar JavaScript. When the page is published and any user (including administrators) visits the page, the unescaped jsonText content renders directly in the HTML output, causing the injected script to execute in their browser context with the permissions of that user. This could steal session cookies, perform actions on behalf of the victim user, deface content, or redirect users to malicious sites, affecting site integrity and user security.