CVE-2026-40722
Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6.
Source: CVE.org
PLUGIN SECURITY
Is Yoast SEO Premium safe?
Improve your SEO with real-time feedback, schema, and clear guidance. Upgrade for AI tools, Google Docs integration, and 24/7 support, no hidden fees.
What this plugin does
- Slug:
wordpress-seo-premium - Author: Yoast
- 10000000+ active installs
- 96/100 rating (27814 reviews on wordpress.org)
- 979113912 all-time downloads
- On WordPress.org since 2010-10-11
Content analysisReadabilityschemaseoxml sitemap
Maintenance status
- Last updated: 2026-07-21 4:57am GMT
- Tested up to WordPress: 7.0.2
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
4 known CVEs on file for Yoast SEO Premium. Reported between 2019 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-40722 | Yoast SEO Premium [wordpress-seo-premium] < 26.7 | Missing Authorization | Medium 5.5 | < 26.7 | 26.7 | 2026-06-17 | — |
| CVE-2025-11241 | Yoast SEO Premium [wordpress-seo-premium] >= 25.7 - < 26.0 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Medium 6.4 | 25.7–26.0 | 26.0 | 2025-10-02 | — |
| CVE-2023-28775 | Yoast SEO Premium [wordpress-seo-premium] < 20.5 | Missing Authorization | Medium 5.3 | < 20.5 | 20.5 | 2023-05-09 | — |
| CVE-2019-13478 | Yoast SEO Premium [wordpress-seo-premium] < 11.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Critical 9.8 | < 11.6 | 11.6 | 2019-07-09 | — |
| — | Yoast SEO Premium [wordpress-seo-premium] < 2.1 | — | Unknown | < 2.1 | 2.1 | — | — |
CVE-2025-11241
The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.
Source: CVE.org
CVE-2023-28775
The Yoast SEO Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in versions up to, and including, 20.4. This makes it possible for unauthenticated attackers to disconnect a Zapier API Key.
Source: Wordfence
CVE-2019-13478
The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via term descriptions in versions up to, and including, 11.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with post editor access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: Wordfence
Yoast SEO Premium [wordpress-seo-premium] < 2.1
The wordpress-seo-premium WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Source: WPScan
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- BoldGrid Easy SEO – Simple and Effective SEO — 40000+ active installs — 60/100 (3) — max PHP 8.4
- Semrush SEO Writing Assistant — 9000+ active installs — 56/100 (25)
- Turn Rank Math FAQ Block to Accordion — 5000+ active installs — 100/100 (2)
- Turn Yoast SEO FAQ Block to Accordion — 3000+ active installs — 100/100 (5)
- Post Admin Word Count — 2000+ active installs — 70/100 (6)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.