CVE-2026-15425 Overview
CVE-2026-15425 is a stored Cross-Site Scripting (XSS) vulnerability in the Yoast SEO plugin for WordPress. The flaw affects all versions up to and including 28.0. Authenticated attackers with author-level access or higher can inject arbitrary web scripts through the Post Slug (post_name) field. The injected payload executes when a user accesses the affected page. Exploitation requires pretty permalinks to be enabled, since the attack chain depends on get_permalink() embedding the percent-encoded post_name value in the generated URL. The vulnerability is tracked under [CWE-79] and stems from insufficient input sanitization and output escaping in the bulk editor list table component.
Critical Impact
Authenticated authors can inject persistent JavaScript that executes in the browser of any user visiting an affected page, enabling session theft and administrative account takeover.
Affected Products
- Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress
- All plugin versions up to and including 28.0
- WordPress sites with pretty permalinks enabled
Discovery Timeline
- 2026-07-25 - CVE-2026-15425 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-15425
Vulnerability Analysis
The vulnerability resides in the Yoast SEO bulk editor list table, specifically in admin/class-bulk-editor-list-table.php around lines 898 and 900. The plugin renders the stored post_name (post slug) value into administrative output without applying adequate sanitization or escaping. When a post is created or modified, an author-level user can craft a slug that contains percent-encoded script content. WordPress stores this slug in the wp_posts table and reuses it whenever get_permalink() builds the canonical URL for the post.
Because pretty permalinks embed the slug directly into the generated URL, and the plugin echoes the resulting URL into HTML contexts without sufficient escaping, the payload becomes an executable script when rendered in the browser. The stored nature of the injection means the payload persists across sessions and fires for every user who loads the affected page in the admin context.
Root Cause
The root cause is a failure to apply output escaping consistent with the HTML context in which the slug-derived URL is rendered. The plugin trusts the stored slug value and does not decode-then-reencode the percent-encoded content before emitting it into an HTML attribute or element body. This category of flaw is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Attack Vector
An authenticated attacker with author privileges creates or edits a post and supplies a malicious slug containing percent-encoded JavaScript. Once the post is saved and pretty permalinks are enabled, get_permalink() returns a URL containing the payload. When an administrator or another user views the Yoast SEO bulk editor page, the payload is decoded and executed in the browser under the site's origin.
The vulnerability manifests in the bulk editor list table rendering logic. See the Wordfence Vulnerability Report and the WordPress SEO Change Set 3598937 for technical details on the affected code paths and the applied fix.
Detection Methods for CVE-2026-15425
Indicators of Compromise
- Post slugs (post_name values in wp_posts) containing percent-encoded angle brackets, script tokens, or javascript: schemes.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading the Yoast SEO bulk editor.
- New administrator accounts, altered user roles, or modified plugin/theme files created after an author-level user edited post slugs.
Detection Strategies
- Audit the wp_posts table for slugs containing suspicious character sequences such as %3C, %3E, %22, or script.
- Review WordPress activity logs for author-level users creating or modifying posts immediately before administrator sessions triggered anomalous behavior.
- Inspect installed Yoast SEO plugin versions across WordPress fleets and flag installations at or below version 28.0.
Monitoring Recommendations
- Enable a web application firewall rule that inspects post slug submissions and blocks percent-encoded HTML metacharacters from non-privileged roles.
- Monitor administrator authentication events for session hijacking indicators, including impossible-travel logins and new API tokens.
- Alert on modifications to critical WordPress tables (wp_users, wp_usermeta, wp_options) that follow bulk editor page visits.
How to Mitigate CVE-2026-15425
Immediate Actions Required
- Update the Yoast SEO plugin to version 28.1 or later on all WordPress installations.
- Review author-level and higher user accounts for legitimacy, and revoke access for any accounts that are no longer required.
- Audit existing post slugs for injected payloads and normalize any values containing HTML metacharacters.
Patch Information
The issue is fixed in Yoast SEO version 28.1. The corrective changes are documented in WordPress SEO Change Set 3598937 and the 28.0 to 28.1 diff. Site operators should apply the update through the WordPress plugin manager or via WP-CLI as soon as possible.
Workarounds
- Restrict post creation and editing to trusted administrator or editor accounts until the plugin can be updated.
- Temporarily disable pretty permalinks, since the exploit chain depends on get_permalink() embedding the slug in the URL output.
- Deploy a web application firewall rule that blocks percent-encoded script payloads in post_name submissions.
# Configuration example: update Yoast SEO via WP-CLI
wp plugin update wordpress-seo --version=28.1
wp plugin list --name=wordpress-seo --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
