PT-2026-26964 · WordPress · Yoast Seo

Publicado 2026-03-22 · Atualizado 2026-03-22 · CVE-2026-3427

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress versions prior to 27.1.2

Description The Yoast SEO plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. When a user accesses an injected page, the scripts will execute. The vulnerability resides in the jsonText block attribute.

Recommendations Versions prior to 27.1.2 should be updated.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3427

Produtos afetados

Yoast Seo

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3427.json · Exploit
• https://github.com/Yoast/wordpress-seo/pull/23035 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3427 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/fee1fef5-5716-49e0-a04e-d0dae527fcfc?source=cve · Nota
• https://twitter.com/CVEnew/status/2035619710751150388 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3475308/wordpress-seo · Nota
• https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.0/src/generators/schema/howto.php#L125 · Nota
• https://twitter.com/VulmonFeeds/status/2035578978182857130 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2035715119523794949 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3427 · Aviso do Fabricante
• https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.0/inc/class-wpseo-utils.php#L915 · Nota