CVE-2025-11241

Published: Oct 3, 2025Modified: Jun 17, 2026Deferred

6.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitability: 3.1 / Impact: 2.7

Source: security@wordfence.com (Secondary)

Description

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.

Related CWEs

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References (3)

https://developer.yoast.com/changelog/yoast-seo-premium/26.0/

Source: security@wordfence.com

https://sec.stealthcopter.com/regexss/

Source: security@wordfence.com

https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e3645d-ed1b-4c51-a463-c2691cb7168d?source=cve

Source: security@wordfence.com

Timeline

No history available yet.