PT-2025-40451 · WordPress · Yoast Seo Premium

Matthew Rollings · Published 2025-10-03 · Updated 2025-10-03 · CVE-2025-11241

Positive Technologies · (AI Summary)

CVSS v3.1

6.4

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Yoast SEO Premium plugin for WordPress versions 25.7 through 25.9

Description The software is susceptible to a Stored Cross-Site Scripting issue stemming from a flawed regular expression used to remove an attribute within post content. This flaw enables the injection of arbitrary HTML attributes, including JavaScript event handlers. A user with Contributor access or higher can exploit this to create a post containing a malicious JavaScript payload.

Recommendations Update to a version beyond 25.9.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-11241

Affected Products

Yoast Seo Premium

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11241 · Security Note
• https://t.me/cveNotify/137283 · Telegram Post
• https://t.me/pentestingnews/69047 · Telegram Post
• https://sec.stealthcopter.com/regexss · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a6e3645d-ed1b-4c51-a463-c2691cb7168d?source=cve · Note
• https://t.me/CVEtracker/33988 · Telegram Post
• https://twitter.com/CVEnew/status/1973940136426516624 · Twitter Post
• https://twitter.com/fridaysecurity/status/1973951541137846434 · Twitter Post
• https://developer.yoast.com/changelog/yoast-seo-premium/26.0 · Note