The vulnerability occurs when user-supplied data is inserted into the yoast-schema block attribute without adequate sanitization or escaping, allowing an attacker to embed malicious JavaScript. The injected payload is persisted in the database and is executed on every page view, giving the attacker a persistent foothold. This yields confidentiality and integrity compromise for any user who visits the compromised page, as well as potential defacement or phishing attacks. The weakness is categorized as CWE‑79, a classic reflected XSS that becomes stored.

The affected product is Yoast SEO – Advanced SEO with real-time guidance and built-in AI for WordPress. All releases up to and including version 26.8 are vulnerable. Systems running WordPress with an active Yoast SEO installation and contributor or higher level access are at risk.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is low. It is not listed in the CISA KEV catalog, so no known active exploits have been recorded. The attack vector requires the attacker to be authenticated with Contributor‑level privileges or higher and to edit or insert a page using the yoast-schema block. Once the payload is stored, any visitor to the affected page will execute the injected script, making the compromise highly actionable for the attacker.