CVE-2025-11241

MediumCVSS 6.4

Published: 03/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

The Yoast SEO Premium plugin for WordPress versions 25.7 to 25.9 is vulnerable to stored XSS due to a flawed regex used to remove an attribute in post content. This can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. A user with Contributor access or higher can create a post containing a malicious JavaScript payload.

Risk Assessment

Execution of malicious JavaScript in the user's browser is possible, potentially leading to session hijacking or data theft. However, it requires content creation privileges.

Recommendation

Update the Yoast SEO Premium plugin to the latest version. Consider restricting Contributor privileges until updated.

Other vulnerabilities in Yoast SEO Premium

CVE-2026-10821Medium
The Yoast SEO Premium WordPress plugin before version 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.

Original NVD description (English source)

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS