CVE-2026-15425 in SEO Plugin
Summary
by MITRE • 07/25/2026
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The Yoast SEO plugin represents one of the most widely deployed seo solutions for wordpress environments, with over 10 million active installations making it a prime target for attackers seeking to compromise wordpress sites. This particular vulnerability exists within the plugin's handling of post slugs through the post_name parameter, which serves as a critical component in wordpress permalink generation and page identification. The flaw specifically impacts versions 28.0 and earlier, creating a persistent security risk that affects all wordpress installations utilizing this popular plugin.
The technical nature of this vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase. When authenticated users with author-level privileges or higher create or modify posts, the post_name parameter is stored without proper validation or encoding. This allows malicious actors to inject javascript payloads directly into the slug field that will be executed whenever the affected page is accessed by any user. The vulnerability operates through a classic stored xss vector where the malicious input is permanently saved and then rendered in subsequent page requests.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with persistent access to compromised wordpress installations. Since the exploit requires only author-level privileges, attackers can leverage existing user accounts or potentially escalate access through social engineering or credential compromise. The requirement for pretty permalinks to be enabled creates a specific attack surface that must be considered when assessing affected environments, as sites with default permalink structures may remain protected from this particular exploitation vector. This vulnerability fundamentally undermines the security model of wordpress installations by allowing content creators to introduce malicious code that executes automatically for all site visitors.
The exploit chain specifically depends on the get_permalink() function embedding the stored percent-encoded post_name parameter into generated urls, creating a direct path from the malicious input to client-side script execution. This design flaw allows attackers to bypass traditional security controls that might otherwise prevent direct script injection, as the malicious code becomes part of the legitimate url generation process. The vulnerability aligns with CWE-79 - Cross-site Scripting and follows patterns identified in the ATT&CK framework under T1566 - Phishing, where compromised user accounts can be leveraged to deliver malicious payloads through seemingly legitimate content management operations.
Mitigation strategies should prioritize immediate plugin updates to versions beyond 28.0 where the vulnerability has been addressed through proper input sanitization and output escaping mechanisms. Organizations should also implement additional security measures including role-based access controls that limit author privileges to only necessary functions, regular security auditing of wordpress installations, and monitoring for suspicious slug modifications. Network-level protections such as web application firewalls can provide additional defense-in-depth, though they should not be relied upon as the primary mitigation strategy. Administrators should also consider implementing content security policies and regularly reviewing user permissions to minimize potential impact from compromised accounts.
The vulnerability demonstrates how seemingly innocuous administrative functions like slug management can create significant security risks when proper input validation is omitted. It highlights the critical importance of sanitizing all user-provided data before storage, particularly in applications that generate urls or other web-facing content. Regular security assessments of popular plugins and continuous monitoring for new vulnerabilities should be integral components of any wordpress security strategy to prevent exploitation of similar flaws in the future.