CVE-2025-14481
The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to read sensitive SEO metadata from any post on the site via the 'post_id' parameter, including posts owned by other users, private posts, and draft posts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
+ 25 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 9.2.0 |
— |
Desconocido
|
< 9.2.0
|
9.2.0 |
2018-11-20 |
✓ corregido en la última versión
|
|
CVE-2018-19370
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 9.2.0 |
Ejecución concurrente con recursos compartidos y sincronización incorrecta (condición de carrera / race condition) |
Media
6,6
|
< 9.2.0
|
9.2.0 |
2018-11-06 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 5.8.0 |
— |
Desconocido
|
< 5.8.0
|
5.8.0 |
2017-11-20 |
✓ corregido en la última versión
|
|
CVE-2017-16842
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 5.8.0 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 5.8.0
|
5.8.0 |
2017-11-16 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.2 |
— |
Desconocido
|
< 3.3.2
|
3.3.2 |
2017-05-11 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.4.1 |
— |
Desconocido
|
< 3.4.1
|
3.4.1 |
2016-08-03 |
✓ corregido en la última versión
|
|
CVE-2021-24153
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.4.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 3.4.1
|
3.4.1 |
2016-08-02 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.5 |
— |
Desconocido
|
< 1.4.5
|
1.4.5 |
2016-07-28 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7 |
— |
Desconocido
|
< 1.4.7
|
1.4.7 |
2016-07-28 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0 |
— |
Desconocido
|
< 3.3.0
|
3.3.0 |
2016-06-14 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0 |
— |
Desconocido
|
< 3.3.0
|
3.3.0 |
2016-06-14 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5 |
— |
Desconocido
|
< 3.2.5
|
3.2.5 |
2016-05-06 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5 |
— |
Desconocido
|
< 3.2.5
|
3.2.5 |
2016-05-06 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.1 |
— |
Desconocido
|
< 2.1
|
2.1 |
2015-04-20 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.1 |
— |
Desconocido
|
< 2.1
|
2.1 |
2015-04-20 |
✓ corregido en la última versión
|
|
CVE-2015-2292
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.7.4 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Desconocido
|
< 1.7.4
|
1.7.4 |
2015-03-11 |
✓ corregido en la última versión
|
|
CVE-2015-2293
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.7.4 |
Falsificación de petición en sitios cruzados (CSRF) |
Desconocido
|
< 1.7.4
|
1.7.4 |
2015-03-10 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7 |
— |
Desconocido
|
< 1.4.7
|
1.4.7 |
2014-08-01 |
✓ corregido en la última versión
|
|
CVE-2012-6692
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.2 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Desconocido
|
< 2.2
|
2.2 |
2012-10-31 |
✓ corregido en la última versión
|
|
CVE-2026-3427
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 27.2 |
— |
Desconocido
|
< 27.2
|
27.2 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2026-1293
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 26.9 |
— |
Desconocido
|
< 26.9
|
26.9 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0 |
— |
Desconocido
|
< 3.3.0
|
3.3.0 |
— |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5 |
— |
Desconocido
|
< 3.2.5
|
3.2.5 |
— |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7 |
— |
Desconocido
|
< 1.4.7
|
1.4.7 |
— |
✓ corregido en la última versión
|
|
—
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.5 |
— |
Desconocido
|
< 1.4.5
|
1.4.5 |
— |
✓ corregido en la última versión
|
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 9.2.0
Authenticated Command Execution vulnerability found by Dimopoulos Elias in WordPress Yoast SEO plugin (versions <= 9.1).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2018-19370
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 5.8.0
Unauthenticated Cross-Site Scripting (XSS) vulnerability found in WordPress Yoast SEO plugin (versions <=5.7.1). Vulnerability found in "admin/google_search_console/class-gsc-table.php" of the WordPress Yoast SEO plugin versions before version 5.8.0, and it allows remote attackers to inject arbitrary web script or HTML.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2017-16842
Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.2
WordPress Yoast SEO plugin Cross-site Request Forgery (CSRF) exists on /wp-admin/admin.php?page=wpseo_tools&tool=import-export page.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.4.1
This plugin is prone to a stored cross site scripting vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2021-24153
A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting parentheses as well as several functions such as alert, but bypasses were found.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.5
This plugin is prone to an security issue which allowed any user to reset settings.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7
This plugin is prone to a reset settings feature access restriction bypass vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0
This plugin is prone to an unspecified cross site scripting vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0
The Yoast SEO plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.2.5 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5
This plugin is prone to a subscriber settings sensitive data exposure vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5
The Yoast SEO plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including 3.2.4. This is due to privileged AJAX actions being executable by regular users. This makes it possible for registered attackers to extract sensitive data including Yoast SEO settings and post metadata relative to focus and term keywords.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.1
This plugin is prone to cross site scripting vulnerability because of misuse of the add_query_arg() and remove_query_arg() functions.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.1
The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on remove_query_arg and add_query_arg. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2015-2292
Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2015-2293
Title: WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection
Version/s Tested: 1.7.3.3
CVSSv2 Base Score: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
CVSSv2 Temporal Score: 7 (AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
Description:
WordPress SEO by Yoast is a popular WordPress plugin (wordpress-seo) used to improve the Search Engine Optimization (SEO) of WordPress sites. The latest version at the time of writing (1.7.3.3) has been found to be affected by two authenticated (admin, editor or author user) Blind SQL Injection vulnerabilities. The plugin has more than one million downloads according to WordPress.
Technical Description:
The authenticated Blind SQL Injection vulnerability can be found within the 'admin/class-bulk-editor-list-table.php' file. The orderby and order GET parameters are not sufficiently sanitised before being used within a SQL query.
Line 529:
$orderby = ! empty( $_GET['orderby'] ) ? esc_sql( sanitize_text_field( $_GET['orderby'] ) ) : 'post_title';
Line 533:
order = esc_sql( strtoupper( sanitize_text_field( $_GET['order'] ) ) );
If the GET orderby parameter value is not empty it will pass its value through WordPess's own esc_sql() function. According to WordPress this function 'Prepares a string for use as an SQL query. A glorified addslashes() that works with arrays.'. However, this is not sufficient to prevent SQL Injection as can be seen from our Proof of Concept.
Proof of Concept (PoC):
The following GET request will cause the SQL query to execute and sleep for 10 seconds if clicked on as an authenticated admin, editor or author user.
http://127.0.0.1/wp-admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date%2c(select%20*%20from%20(select(sleep(10)))a)&order=asc
Using SQLMap:
python sqlmap.py -u "http://127.0.0.1/wp-admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date*&order=asc" --batch --technique=B --dbms=MySQL --cookie="wordpress_9d...; wordpress_logged_in_9dee67...;"
Impact:
As there is no anti-CSRF protection a remote unauthenticated attacker could use this vulnerability to execute arbitrary SQL queries on the victim WordPress web site by enticing an authenticated admin, editor or author user to click on a specially crafted link or visit a page they control.
One possible attack scenario would be an attacker adding their own administrative user to the target WordPress site, allowing them to compromise the entire web site.
Timeline:
March 10th 2015 - 15:30 GMT: Vulnerability discovered by Ryan Dewhurst (WPScan Team - Dewhurst Security).
March 10th 2015 - 18:30 GMT: Technical review by FireFart (WPScan Team).
March 10th 2015 - 20:00 GMT: Vendor contacted via email.
March 10th 2015 - 21:25 GMT: Vendor replies, confirms issue and gave expected patch timeline.
March 11th 2015 - 12:05 GMT: Vendor released version 1.7.4 which patches this issue.
March 11th 2015 - 12:30 GMT: Advisory released.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7
The Yoast SEO plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the reset settings function in versions up to, and including, 1.4.6. This makes it possible for unauthorized attackers to reset the plugin's settings.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2012-6692
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2026-3427
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `jsonText` block attribute in all versions up to, and including, 27.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-1293
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schema` block attribute in all versions up to, and including, 26.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0
Changelog file for version 3.3.0 states "Fixes an XSS issue, props Hristo Pandjarov."
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5
The Yoast SEO WordPress plugin was affected by a Subscriber Settings Sensitive Data Exposure security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7
The Yoast SEO WordPress plugin was affected by a Reset Settings Feature Access Restriction Bypass security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.5
The Yoast SEO WordPress plugin was affected by a Security issue which allowed any user to reset settings security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Mantén Yoast SEO actualizado — 28.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.