Yoast

Products

Product	CVEs	Exploited	Latest
Yoast SEO – Advanced SEO with real-time guidance and built-in AI	6	–	Jul 25, 2026
Yoast Duplicate Post	3	–	Jun 10, 2026
Yoast SEO: Local	2	–	Aug 23, 2023
Yoast Local Premium	1	–	Nov 18, 2023
Yoast SEO Premium	1	–	Jun 11, 2024

Exploited and recent CVEs

CVE-2026-15425 Medium 6.4 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name) 0.3%
CVE-2026-53740 Medium 5.4 Yoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish Notice 0.1%
CVE-2026-53739 Medium 4.3 Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice 0.1%
CVE-2025-14481 Medium 4.3 Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter 0.3%
CVE-2026-3427 Medium 6.4 Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute 0.2%
CVE-2026-1217 Medium 5.4 Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite 0.2%
CVE-2026-1293 Medium 6.4 Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute 0.2%
CVE-2023-28775 Medium 5.3 WordPress Yoast SEO Premium plugin <= 20.4 - Unauthenticated Zapier API Key Reset vulnerability 0.4%
CVE-2024-4984 Medium 6.4 Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.6%
CVE-2024-4041 Medium 6.1 Yoast SEO <= 22.5 - Reflected Cross-Site Scripting 0.8%
CVE-2023-28780 Medium 6.5 WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Request Forgery (CSRF) 0.4%
CVE-2023-32300 High 7.1 WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Scripting (XSS) 0.4%
CVE-2023-28785 Medium 6.5 WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS) 0.4%