CVE-2025-11241

MEDIUM 6.4 CVSS 3.1

Published: October 3, 2025
Last modified: October 19, 2026
NVD status: Deferred
Reported by: security@wordfence.com
Weakness: CWE-80
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Description

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.

Affected products and versions

n/a Yoast SEO Premium — From 25.7 (including) to 25.9 (including)

References

developer.yoast.com https://developer.yoast.com/changelog/yoast-seo-premium/26.0/
sec.stealthcopter.com https://sec.stealthcopter.com/regexss/
www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e3645d-ed1b-4c51-a463-c2691cb7168d?source=cve
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References