These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execu [truncated]
CVE-2026-53740 is a MEDIUM-severity vulnerability (CVSS Score: 5.1) in the Yoast Duplicate Post plugin for WordPress, affecting versions through 4.6. The vulnerability allows an attacker to inject an unescaped post title and permalink into the Classic Editor scheduled republish notice. By scheduling a republish copy with a crafted title, an attacker can execute a script when an administrator views the res [truncated]
CVE-2026-53739 is a medium-severity cross-site request forgery vulnerability in Yoast Duplicate Post through version 4.6. The vulnerability exists in the `duplicate_post_dismiss_notice` handler, which fails to verify a nonce or capability. This allows attackers to trick any authenticated user into sending a request that sets the `duplicate_post_show_notice` site option, effectively suppressing admin notic [truncated]
CVE-2025-14481 is a medium-severity Insecure Direct Object Reference (IDOR) vulnerability in the Yoast SEO WordPress plugin affecting all versions up to and including 26.5. The vulnerability resides in the Meta Search REST API endpoint, which fails to properly validate post ownership before returning SEO metadata. Authenticated attackers with Contributor-level privileges or higher can exploit this flaw by [truncated]