PT-2026-6718 · WordPress · Yoast Seo

Suyoung Kim · Publicado 2026-02-06 · Atualizado 2026-02-06 · CVE-2026-1293

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Yoast SEO versions prior to 26.9

Description The Yoast SEO plugin for WordPress is affected by a Stored Cross-Site Scripting issue. Insufficient input sanitization and output escaping in the yoast-schema block attribute allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

Recommendations Update Yoast SEO to version 26.9 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-1293

Produtos afetados

Yoast Seo

Referências · 8

• https://t.me/cveNotify/151119 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1293 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/26.8/src/presenters/schema-presenter.php#L49 · Nota
• https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/26.8/src/generators/schema-generator.php#L188 · Nota
• https://t.me/CVEtracker/43935 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/26.8/inc/class-wpseo-utils.php#L915 · Nota
• https://twitter.com/VulmonFeeds/status/2019812956041547828 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/8b2e7c2d-ed2f-439b-9cee-f2e5d46121b6?source=cve · Nota