Description (CNA)
The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / Yoast SEO Premium | affected 25.7 through 25.9 |
CWE
CWE-80
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e3645d-ed1b-4c51-a463-c2691cb7168d?source=cve
- https://developer.yoast.com/changelog/yoast-seo-premium/26.0/
- https://sec.stealthcopter.com/regexss/
ADP enrichment
No English description supplied.
No references supplied.