PT-2026-6718 · WordPress · Yoast Seo

Suyoung Kim · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-1293

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Yoast SEO versions prior to 26.9

Description The Yoast SEO plugin for WordPress is affected by a Stored Cross-Site Scripting issue. Insufficient input sanitization and output escaping in the yoast-schema block attribute allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

Recommendations Update Yoast SEO to version 26.9 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1293

Affected Products

Yoast Seo

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1293 · Security Note
• https://t.me/cveNotify/151119 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/26.8/src/presenters/schema-presenter.php#L49 · Note
• https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/26.8/src/generators/schema-generator.php#L188 · Note
• https://t.me/CVEtracker/43935 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/26.8/inc/class-wpseo-utils.php#L915 · Note
• https://twitter.com/VulmonFeeds/status/2019812956041547828 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8b2e7c2d-ed2f-439b-9cee-f2e5d46121b6?source=cve · Note