What is the CVSS score of EUVD-2026-14273?

EUVD-2026-14273 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-14273?

Organizations using all should be aware of moderate risk from CVE-2026-3427, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate EUVD-2026-14273?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress EUVD-2026-14273

| CVE-2026-3427 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-22 Wordfence

GHSA-84j4-wrx9-vrgx

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 22, 2026 - 03:45 euvd

EUVD-2026-14273

Analysis Generated

Mar 22, 2026 - 03:45 vuln.today

CVE Published

Mar 22, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Yoast SEO - Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the jsonText block attribute in all versions up to, and including, 27.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in Yoast SEO plugin for WordPress versions up to 27.1.1, where the jsonText block attribute fails to properly sanitize and escape user input, allowing authenticated contributors and above to inject malicious scripts that execute in the browsers of all users accessing the compromised pages. The vulnerability has a CVSS score of 6.4 (Medium severity) and requires only low-level authenticated access with no user interaction needed for payload execution, though it is limited to authenticated attackers and does not affect confidentiality or availability significantly.

Technical ContextAI

The vulnerability stems from insufficient input sanitization and output escaping in WordPress block attributes, specifically the jsonText parameter used in Yoast SEO's schema and structured data generation components. The affected product, identified via CPE as cpe:2.3:a:yoast:yoast_seo_–_advanced_seo_with_real-time_guidance_and_built-in_ai, implements WordPress blocks for SEO functionality including schema markup generation (as evidenced by references to schema/howto.php). The root cause falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application vulnerability where user-controlled data is rendered in HTML context without proper escaping. The WordPress plugin architecture allows contributors to edit posts and pages containing blocks, and the Yoast SEO plugin's block implementation failed to escape the jsonText attribute before rendering it to the page output, enabling XSS payload injection that persists in the post content.

RemediationAI

Organizations should immediately upgrade Yoast SEO to version 27.2 or later, which includes fixes for the jsonText block attribute sanitization and escaping as documented in changeset 3475308 and GitHub PR #23035. Until patches can be applied, administrators should restrict Contributor-level access to only trusted users, disable block editing for the Yoast SEO blocks via role-based access controls, and audit existing posts and pages containing Yoast blocks for signs of injected scripts (particularly looking for <script> tags or event handlers in block content). WordPress site administrators can also implement a Content Security Policy (CSP) header to mitigate XSS impact by preventing inline script execution, though this is a defense-in-depth measure and not a substitute for patching. For detailed remediation guidance, refer to the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/fee1fef5-5716-49e0-a04e-d0dae527fcfc and the WordPress plugin security advisory.