Yoast SEO Premium Flaw: Stored XSS Bug (CVE-2025-11241) Exposes Millions of WordPress Sites

Yoast SEO Premium has a stored XSS flaw, CVE-2025-11241, that potentially exposes millions of WordPress sites, with the vulnerability affecting versions 25.7 through 25.9 and rated CVSS 6.4 (Medium). The flaw stems from a flawed regular expression used to remove attributes in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers, enabling attackers with at least Contributor-level access to insert malicious payloads into posts.

These payloads could then execute in the browsers of site administrators or visitors, though the issue is limited to authenticated users with Contributor permissions or higher. According to Wordfence Threat Intel advisory, this vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.

Yoast addressed the issue in version 26.0, with the changelog noting fixes to a security defect where users with edit_posts capabilities (Contributor+) could execute stored XSS if the plugin’s AI feature was enabled, and the minimum required version was raised to 26.0.