CVE-2026-15425: Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (postname) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on getpermalink() embedding the stored percent-encoded postname in the generated URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Yoast SEO – Advanced SEO with real-time guidance and built-in AIto a version that resolves this vulnerability.Fixed in 28.0 - Compensating control
Ensure pretty permalinks are not enabled, since the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15425?
CVE-2026-15425 has a medium severity rating of 6.4.
How do I fix CVE-2026-15425?
To fix CVE-2026-15425, update the Yoast SEO plugin to version 28.1 or later.
What type of vulnerability is CVE-2026-15425?
CVE-2026-15425 is a Stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-15425?
Authenticated users with Author+ role in WordPress are affected by CVE-2026-15425.
What causes the vulnerability CVE-2026-15425?
CVE-2026-15425 is caused by insufficient input sanitization and output escaping in the Yoast SEO plugin.