Stored Cross-Site Scripting Vulnerability in Yoast SEO Premium Plugin for WordPress

CVE-2025-11241

What is CVE-2025-11241?

The Yoast SEO Premium plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability, primarily due to an inadequate regex implementation used to sanitize post content. This flaw allows users with Contributor or higher permissions to inject arbitrary HTML attributes, including harmful JavaScript event handlers, into posts. Consequently, this can lead to the execution of malicious scripts on affected websites, compromising site integrity and user data security.

References