# CVE-2026-15425: Yoast SEO Stored XSS in Post Slug

Source: https://junglewise.ai/threats/cve-2026-15425-yoast-seo-stored-xss-in-post-slug  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-25. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-15425 · Severity: medium · CVSS 6.4 · Published 2026-07-25

Yoast SEO is a widely used WordPress plugin that helps websites optimize their content for search engines. A security vulnerability allows users with author-level permissions to inject malicious scripts into the website's page links. If exploited, these scripts could run in the browsers of other users or administrators, potentially leading to unauthorized actions or data theft.

Vendors: [Yoast](https://junglewise.ai/threats/vendors/yoast).

## Quick answers

**Is CVE-2026-15425 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15425 being exploited in the wild.

**How severe is CVE-2026-15425?** Medium severity, with a CVSS score of 6.4, published 25 July 2026.

**Which products and versions are affected?** Yoast SEO up to and including 28.0.

**Is there a fix for CVE-2026-15425?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15425 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15425?** Check whether you run Yoast SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw residing in the bulk editor component of the Yoast SEO plugin. It stems from insufficient input sanitization and output escaping of the 'post_name' (Post Slug) field. An authenticated attacker with author-level privileges or higher can inject malicious scripts into the slug. The exploit is triggered when 'pretty permalinks' are enabled, as the 'get_permalink()' function embeds the stored, percent-encoded malicious payload into generated URLs. When a user views a page where this URL is rendered, the script executes in their browser context. The issue is addressed in version 28.1.

## Affected products

- Yoast Yoast SEO up to and including 28.0

## Timeline

- 2026-07-25: disclosed
- 2026-07-25: advisory

## References

- [https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php](https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php)
- [https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php](https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php)
- [https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php](https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php)
- [https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php](https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php)
- [https://plugins.trac.wordpress.org/changeset/3598937/wordpress-seo/trunk/admin/class-bulk-editor-list-table.php](https://plugins.trac.wordpress.org/changeset/3598937/wordpress-seo/trunk/admin/class-bulk-editor-list-table.php)
- [https://plugins.trac.wordpress.org/changeset?old_path=%2Fwordpress-seo/tags/28.0&new_path=%2Fwordpress-seo/tags/28.1](https://plugins.trac.wordpress.org/changeset?old_path=%2Fwordpress-seo/tags/28.0&new_path=%2Fwordpress-seo/tags/28.1)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fa1b7-a5af-4ea6-9bee-19a6cdfd7701?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fa1b7-a5af-4ea6-9bee-19a6cdfd7701?source=cve)

## Related threats

- [Yoast SEO IDOR in Meta Search REST API endpoint](https://junglewise.ai/threats/cve-2025-14481-yoast-seo-idor-in-meta-search-rest-api-endpoint)