Stored Cross-Site Scripting Vulnerability in Yoast SEO Premium Plugin for WordPress

CVE-2025-11241

What is CVE-2025-11241?

The Yoast SEO Premium plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability, primarily due to an inadequate regex implementation used to sanitize post content. This flaw allows users with Contributor or higher permissions to inject arbitrary HTML attributes, including harmful JavaScript event handlers, into posts. Consequently, this can lead to the execution of malicious scripts on affected websites, compromising site integrity and user data security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References