CVE-2026-15425

Name of the Vulnerable Software and Affected Versions Yoast SEO versions prior to 28.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. The exploit requires pretty permalinks to be enabled, as it relies on the get permalink() function embedding the stored percent-encoded post name variable in the generated URL.

Recommendations Update to a version newer than 28.0.