CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.
Explanation of Vulnerability in Simple Terms
Yoast SEO Premium versions 25.7 through 25.9 contain a cross-site scripting (XSS) vulnerability that allows authenticated users with low privileges to inject malicious scripts. The vulnerability has a changed scope, meaning the impact can extend beyond the vulnerable component itself. An attacker can read or modify site data and user sessions without requiring user interaction.
What an attacker can do
Inject malicious scripts that execute in other users' browsers and read or modify site data.
Potential impact on your site
Authenticated users can inject scripts affecting other users' sessions and data integrity across your site.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
