PatchSiren cyber security CVE debrief
CVE-2026-15425 yoast CVE debrief
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
- Vendor
- yoast
- Product
- Yoast SEO – Advanced SEO with real-time guidance and built-in AI
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-25
- Original CVE updated
- 2026-07-25
- Advisory published
- 2026-07-25
- Advisory updated
- 2026-07-25
Who should care
Users of the Yoast SEO plugin for WordPress, particularly those with author-level access or above, should be aware of this vulnerability and take steps to protect their sites. Affected operators should review their deployments and ensure that the plugin is updated to version 28.1 or later. Platform administrators should verify that pretty permalinks are not required for critical functionality and consider implementing additional security measures such as Web Application Firewall (WAF) rules to detect and prevent exploitation attempts. Vulnerability management and security teams should monitor for suspicious page access patterns and restrict author-level access and above to trusted users.
Technical summary
The vulnerability exists in the Yoast SEO plugin's handling of Post Slug (post_name) input. Insufficient sanitization and output escaping allow authenticated attackers with author-level access or above to inject arbitrary web scripts. These scripts will execute when a user accesses an injected page. The exploit requires pretty permalinks to be enabled, as it relies on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
Defensive priority
Medium priority due to the requirement for authenticated access and specific configuration (pretty permalinks enabled).
Recommended defensive actions
- Update the Yoast SEO plugin to version 28.1 or later
- Ensure pretty permalinks are not required for critical functionality
- Monitor for suspicious page access patterns
- Restrict author-level access and above to trusted users
- Consider implementing additional security measures such as Web Application Firewall (WAF) rules to detect and prevent exploitation attempts
Evidence notes
The CVE record was published on 2026-07-25T07:17:09.897Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Multiple source references are provided, including links to the WordPress plugin repository and Wordfence threat intelligence.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-25T07:17:09.897Z and has not been modified since then. The NVD entry is currently in the 'Received' status.