Junglewise Threat Intelligence

CVE-2026-15425: Yoast SEO Stored XSS in Post Slug

CVE-2026-15425 · Severity: medium · CVSS 6.4 · Published 2026-07-25

Vendors: Yoast.

Executive brief

Yoast SEO is a widely used WordPress plugin that helps websites optimize their content for search engines. A security vulnerability allows users with author-level permissions to inject malicious scripts into the website's page links. If exploited, these scripts could run in the browsers of other users or administrators, potentially leading to unauthorized actions or data theft.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw residing in the bulk editor component of the Yoast SEO plugin. It stems from insufficient input sanitization and output escaping of the 'post_name' (Post Slug) field. An authenticated attacker with author-level privileges or higher can inject malicious scripts into the slug. The exploit is triggered when 'pretty permalinks' are enabled, as the 'get_permalink()' function embeds the stored, percent-encoded malicious payload into generated URLs. When a user views a page where this URL is rendered, the script executes in their browser context. The issue is addressed in version 28.1.

Affected products

  • Yoast Yoast SEO up to and including 28.0

Timeline

  • 2026-07-25: disclosed
  • 2026-07-25: advisory

References

Related threats