Yoast Seo – Advanced Seo With Real Time Guidance And Built In Ai
Approved changes feed: RSS · Atom
cpe:2.3:a:yoast:yoast_seo_–_advanced_seo_with_real-time_guidance_and_built-in_ai:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Yoast (73453df7-06f9-5a08-ba8b-ba3ccdcb48d1) |
|---|---|
| Product | Yoast Seo – Advanced Seo With Real Time Guidance And Built In Ai (9198e03c-776b-5dc1-be53-6bc2b98971a6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3427 |
vulnerable | 2026-06-08 08:01:18.602441 |
Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute
MEDIUM (6.4)
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `jsonText` block attribute in all versions up to, and including, 27.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-03-22T03:26:35.127Z
Updated: 2026-04-08T17:35:14.548Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1293 |
vulnerable | 2026-06-08 07:49:08.190342 |
Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute
MEDIUM (6.4)
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schema` block attribute in all versions up to, and including, 26.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-02-06T11:21:30.973Z
Updated: 2026-04-08T17:05:48.147Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14481 |
vulnerable | 2026-06-08 07:06:34.544808 |
Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter
MEDIUM (4.3)
The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to read sensitive SEO metadata from any post on the site via the 'post_id' parameter, including posts owned by other users, private posts, and draft posts.
Published: 2026-05-27T04:28:59.011Z
Updated: 2026-05-27T10:41:24.847Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4984 |
vulnerable | 2026-06-08 06:52:08.703448 |
Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
MEDIUM (6.4)
The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-05-16T02:02:35.901Z
Updated: 2026-04-08T16:54:54.267Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4041 |
vulnerable | 2026-06-08 06:50:16.908915 |
Yoast SEO <= 22.5 - Reflected Cross-Site Scripting
MEDIUM (6.1)
The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 22.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published: 2024-05-09T20:03:25.752Z
Updated: 2026-04-08T16:51:39.026Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.