Skip to content
Noroxi

Yoast SEO – Advanced SEO with real-time guidance and built-in AI

wordpress-seo · plugin

Known security vulnerabilities for Yoast SEO – Advanced SEO with real-time guidance and built-in AI. Find out in seconds which version runs on your site with WP Lens.

13 known vulnerabilities

1 exploitable without logging in · 2 with public exploit code · latest Jul 25, 2026

Listed on wordpress.org · latest 28.6 · last updated Sep 29, 2026 · 10M+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2015-2293

    Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin be

    Medium 6.8

  • CVE-2018-19370high privilege

    A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0

    Medium 6.6

  • CVE-2015-2292login required

    Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x be

    Medium 6.5

  • CVE-2026-15425author+≤ 28.0

    Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

    Medium 6.4

  • CVE-2026-3427contributor+≤ 27.1.1

    Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute

    Medium 6.4

  • CVE-2026-1293contributor+≤ 26.8

    Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute

    Medium 6.4

  • CVE-2024-4984contributor+≤ 22.6

    Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2024-4041unauthenticated · needs a click≤ 22.5

    Yoast SEO <= 22.5 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2021-24153login required→ 3.4.1

    Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)

    Medium 5.4

  • CVE-2023-40680high privilege≤ 21.0

    WordPress Yoast SEO Plugin <= 21.0 is vulnerable to Cross Site Scripting (XSS)

    Medium 4.8

  • CVE-2017-16842high privilege

    Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPre

    Medium 4.8

  • CVE-2025-14481contributor+≤ 26.5

    Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter

    Medium 4.3

  • CVE-2012-6692

    Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory