Is Yoast SEO safe? Known vulnerabilities & security (2026)

Known vulnerabilities, PHP compatibility and safer alternatives for the Yoast SEO WordPress plugin — checked against WP Clinic's local security database.

Plugin details

Slug: wordpress-seo
Requires PHP: 7.4+
Max supported PHP (analyzed): 8.4

Known vulnerabilities

Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 17.3 [CVE-2021-25118, WordPress Yoast SEO <= 17.2.1 - Unauthenticated Full Path Disclosure vulnerability, Yoast SEO <= 17.2 - Full Path Disclosure, Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.4.1 [CVE-2021-24153, Yoast SEO <= 3.4.0 - Authenticated Stored Cross-Site Scripting, Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 11.6 [CVE-2019-13478, WordPress Yoast SEO plugin 1.2.0-11.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability, Yoast SEO <= 11.5 - Authenticated Stored Cross Site Scripting, Yoast SEO 1.2.0-11.5 - Authenticated Stored XSS]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 9.2.0 [CVE-2018-19370, Yoast SEO <= 9.1.0 - Race Condition to Remote Code Execution, Yoast SEO <= 9.1 - Authenticated Race Condition]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 5.8.0 [CVE-2017-16842, Yoast SEO <= 5.7.1 - Reflected Cross-Site Scripting, Yoast SEO <= 5.7.1 - Authenticated Cross-Site Scripting (XSS)]

+ 28 more known vulnerabilities

Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.2 [CVE-2012-6692, Yoast SEO <= 2.1.1 - Cross Site Scripting via post_title parameter, Yoast SEO <= 2.1.1 - Authenticated Stored DOM XSS]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.7.4 [CVE-2015-2292, WordPress SEO by Yoast Plugin 1.7.3.3 - Blind SQL Injection, Yoast SEO <= 1.7.3.3 - Blind SQL Injection]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.7.4 [CVE-2015-2293, WordPress SEO by Yoast Plugin <= 1.7.3 - Multiple Vulnerabilities, Yoast SEO <= 1.7.3.3 - Cross-Site Request Forgery, Yoast SEO <= 1.7.3.3 - Blind SQL Injection]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 9.2.0 [WordPress Yoast SEO plugin <= 9.1.0 - Authenticated Command Execution vulnerability]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 5.8.0 [WordPress Yoast SEO plugin <=5.7.1 - Unauthenticated Cross-Site Scripting (XSS) vulnerability]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.2 [WordPress Yoast SEO plugin <= 3.3.1 - Cross-site Request Forgery (CSRF) Vulnerability]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.4.1 [WordPress SEO by Yoast Plugin <= 3.4.0 - Cross Site Scripting]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.5 [WordPress SEO by Yoast Plugin <= 1.4.4 - Unknown Vulnerability]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7 [WordPress SEO by Yoast Plugin <= 1.4.6 - Bypass]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0 [WordPress SEO by Yoast Plugin <= 3.2.5 - Cross Site Scripting]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5 [WordPress SEO by Yoast Plugin <= 3.2.4 - Sensitive Data Exposure]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.1 [WordPress SEO by Yoast Plugin <= 2.0.1 - Cross Site Scripting]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0 [Yoast SEO <= 3.2.5 - Cross-Site Scripting]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5 [Yoast SEO <= 3.2.4 - Sensitive Data Exposure]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 2.1 [Yoast SEO <= 2.0.1 - Reflected Cross-Site Scripting]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7 [Yoast SEO <= 1.4.6 - Missing Authorization]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 20.2.1 [Yoast SEO <= 20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 20.2.1 [WordPress Yoast SEO Plugin <= 20.2 is vulnerable to Cross Site Scripting (XSS)]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.3.0 [Yoast SEO <= 3.2.5 - Unspecified Cross-Site Scripting (XSS)]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 3.2.5 [Yoast SEO <= 3.2.4 - Subscriber Settings Sensitive Data Exposure]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.7 [Yoast SEO < 1.4.7 - Reset Settings Feature Access Restriction Bypass]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 1.4.5 [Yoast SEO - Security issue which allowed any user to reset settings]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 21.1 [CVE-2023-40680, WordPress Yoast SEO Plugin <= 21.0 is vulnerable to Cross Site Scripting (XSS), Yoast SEO <= 21.0 - Authenticated (Seo Manager+) Stored Cross-Site Scripting, Yoast SEO < 21.1 - Authenticated (Seo Manager+) Stored Cross-Site Scripting]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 22.6 [CVE-2024-4041, WordPress Yoast SEO Plugin <= 22.5 is vulnerable to Cross Site Scripting (XSS), Yoast SEO <= 22.5 - Reflected Cross-Site Scripting]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 22.7 [CVE-2024-4984, Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting, WordPress Yoast SEO Plugin <= 22.6 is vulnerable to Cross Site Scripting (XSS)]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 27.2 [CVE-2026-3427, Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 26.9 [CVE-2026-1293, Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute]
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo] < 26.6 [CVE-2025-14481, Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

BoldGrid Easy SEO – Simple and Effective SEO — 40000+ active installs — max PHP 8.4
Semrush SEO Writing Assistant — 9000+ active installs
Turn Rank Math FAQ Block to Accordion — 5000+ active installs
Turn Yoast SEO FAQ Block to Accordion — 3000+ active installs
Post Admin Word Count — 2000+ active installs

Is Yoast SEO safe?

Plugin details

Known vulnerabilities

Safer / more established alternatives

Check your own WordPress site