The Yoast SEO WordPress plugin allows authenticated users with Contributor or higher privileges to modify content that contains a ‘jsonText’ block attribute. Because input validation and output escaping are insufficient, this flaw permits the injection of arbitrary JavaScript code. An attacker who can gain or exploit such a role can embed malicious script that will run whenever a user views the affected page or post, leading to defacement, cookie theft, or redirection to malicious sites.

WordPress sites that have the Yoast SEO – Advanced SEO with real‑time guidance and built‑in AI plugin installed in any released version equal to or older than 27.1.1. This includes all users of that plugin who hold Contributor level access or higher.

The CVSS score of 6.4 indicates a moderate severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Exploitation requires valid authentication to WordPress; an attacker must obtain Contributor or higher role. Once logged in, the attacker can create or modify a block containing the ‘jsonText’ attribute to inject script, which will execute with the browser context of any user who visits the page. While the vulnerability does not grant arbitrary code execution on the server, it can compromise confidentiality and integrity of the affected site and its users.