CVE-2025-11241: Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-03 · updated 2026-10-19
Weakness: CWE-80

Description

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.

Affected products

Yoast SEO Premium: from 25.7 through 25.9

References

https://developer.yoast.com/changelog/yoast-seo-premium/26.0/
https://sec.stealthcopter.com/regexss/
https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e3645d-ed1b-4c51-a463-c2691cb7168d?source=cve

Get alerted when CVE-2025-11241 or the next vulnerability affects your stack