Yoast vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20243
3. 20268

Newest CVEs

• CVE-2026-15425

  Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

  yoast · Yoast SEO – Advanced SEO with real-time guidance and built-in AI

  Medium6.4
• CVE-2026-53740

  Yoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish Notice

  Yoast · Yoast Duplicate Post

  Medium5.1
• CVE-2026-53739

  Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice

  Yoast · Yoast Duplicate Post

  Medium5.1
• CVE-2025-14481

  Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter

  yoast · Yoast SEO – Advanced SEO with real-time guidance and built-in AI

  Medium4.3
• CVE-2026-3427

  Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute

  yoast · Yoast SEO – Advanced SEO with real-time guidance and built-in AI

  Medium6.4
• CVE-2026-1217

  Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite

  yoast · Yoast Duplicate Post

  Medium5.4
• CVE-2019-25314

  Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting

  Yoast · Duplicate-Post

  Medium4.8
• CVE-2026-1293

  Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute

  yoast · Yoast SEO – Advanced SEO with real-time guidance and built-in AI

  Medium6.4
• CVE-2023-28775

  WordPress Yoast SEO Premium plugin <= 20.4 - Unauthenticated Zapier API Key Reset vulnerability

  Yoast · Yoast SEO Premium

  Medium5.3
• CVE-2024-4984

  Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

  yoast · Yoast SEO – Advanced SEO with real-time guidance and built-in AI

  Medium6.4