The Yoast SEO plugin for WordPress is vulnerable to stored cross‑site scripting triggered by the post slug (post_name) field. The plugin fails to sanitize or escape user‑provided input before persisting the slug in the database, and when pretty permalinks are enabled the slug is incorporated into the URL via get_permalink. An authenticated attacker with author‑level or higher privileges can embed JavaScript in the slug, causing that code to execute in the browsers of visitors who load the affected page.

All versions of the Yoast SEO – Advanced SEO with real‑time guidance and built‑in AI plugin up to and including 28.0 are vulnerable. Versions 28.1 and later contain a fix that sanitizes and escapes the post_name field to prevent this attack.

The CVSS score of 6.4 classifies this vulnerability as moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires pretty permalinks to be enabled and the attacker to possess author‑level or higher access. Once the malicious slug is stored, the embedded script will run in any visitor’s browser when the compromised page is viewed, potentially hijacking user sessions or defacing the site.