CVE-2026-15425: 
WordPress vulnerability analysis and mitigation

CVE-2026-15425 is a Stored Cross-Site Scripting (XSS) vulnerability in the Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress. It affects all versions up to and including 28.0, allowing authenticated attackers with author-level access or above to inject arbitrary web scripts via the Post Slug (post_name) field. The vulnerability was published on July 25, 2026, and a patch is available in version 28.1. It carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (GitHub Advisory, Wordfence).

The root cause is insufficient input sanitization and output escaping of the post_name (post slug) field, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The exploit chain depends on WordPress's get_permalink() function embedding the stored, percent-encoded post_name value into the generated URL, which is then rendered without proper escaping in the Yoast SEO Bulk Editor list table (admin/class-bulk-editor-list-table.php, lines 898 and 900). Exploitation requires that WordPress pretty permalinks be enabled; without this setting, the malicious slug is not embedded in the URL and the XSS payload is not triggered. The vulnerability is network-exploitable with low attack complexity and requires only low privileges (author-level) (GitHub Advisory, Wordfence, WordPress Trac).

Successful exploitation allows any authenticated user with author-level access or above to inject arbitrary JavaScript into post slugs, which then executes in the browsers of any visitor who accesses the affected page. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and potential site defacement or malware distribution. The scope is changed, meaning the injected script can affect users beyond the vulnerable component itself (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running Yoast SEO plugin version 28.0 or earlier with pretty permalinks enabled (Settings > Permalinks in WordPress admin).
2. Obtain author-level access: Log in or register as a user with at least author-level privileges on the target WordPress site.
3. Craft malicious post slug: Create or edit a post and set the post slug (post_name) to a value containing a percent-encoded XSS payload (e.g., my-post%22><script>alert(document.cookie)</script>).
4. Save the post: Submit the post, causing the malicious slug to be stored in the WordPress database.
5. Trigger execution: When an administrator or other user visits the Yoast SEO Bulk Editor page (or any page where get_permalink() renders the slug without proper escaping), the injected script executes in their browser.
6. Achieve objective: The executed script can steal session cookies, perform actions as the victim user, or redirect to attacker-controlled infrastructure (GitHub Advisory, WordPress Trac).

• Logs: WordPress access logs showing requests to the Bulk Editor admin page (/wp-admin/admin.php?page=wpseo_bulk-editor) from unusual IP addresses or at unusual times; error logs showing unexpected JavaScript-related output.
• File System: Unexpected modifications to post slugs in the WordPress database (wp_posts.post_name column) containing percent-encoded special characters such as %22, %3C, %3E, or <script> patterns.
• Network: Outbound requests from victim browsers to attacker-controlled domains following visits to affected pages; unusual POST or GET requests to external URLs originating from the WordPress admin interface.
• Database: Post slugs in wp_posts containing encoded HTML/JavaScript payloads (e.g., %22><script>, javascript:, onerror=) (Wordfence).

Update the Yoast SEO plugin to version 28.1 or later, which includes the fix applied in changeset 3598937 to admin/class-bulk-editor-list-table.php. As a temporary workaround if immediate patching is not possible, disabling WordPress pretty permalinks (Settings > Permalinks > Plain) will prevent exploitation, since the attack chain depends on get_permalink() embedding the slug in the URL. Additionally, restrict author-level and above access to only trusted users to reduce the attack surface (GitHub Advisory, WordPress Trac Changeset).