Executive brief
A vulnerability exists in the Surbma Yoast SEO Breadcrumb Shortcode plugin for WordPress, which is used to display navigation breadcrumbs on websites. An attacker with contributor-level access can inject malicious scripts into the site. If a site visitor or administrator views the affected content, these scripts could redirect users to malicious websites, steal session information, or display unauthorized advertisements.
Technical details
The Surbma | Yoast SEO Breadcrumb Shortcode plugin for WordPress (versions <= 1.2) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input sanitization and output escaping on shortcode attributes. An attacker with 'Contributor' or higher privileges can inject arbitrary JavaScript payloads into a post or page. When a victim (such as an administrator or site visitor) views the page, the script executes in their browser context. This is tracked as CWE-79 and has a CVSS base score of 6.5. As of the advisory date, no official patch has been released.
Affected products
- Surbma Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2
Timeline
- 2026-02-06: other: Reported by researcher zaim
- 2026-07-02: advisory: Published by Patchstack and NVD