Known vulnerabilities in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

Real-time SEO guidance, schema, and AI built in. Help search engines and AI systems understand your content. All AI tools included, no hidden fees.

18Reported vulnerabilities

6.8Highest CVSS score

28.3Latest version

10,000,000+Active installs

What to do now

Update Yoast SEO – Advanced SEO with real-time guidance and built-in AI to 28.1 or later. 18 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 18, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2015-2292	Medium 6.5	5.8%	1.5.6 and earlier 1.6.0 to 1.6.0 (inclusive) 1.6.1 to 1.6.1 (inclusive) 1.6.2 to 1.6.2 (inclusive) 1.6.3 to 1.6.3 (inclusive) 1.7.1 to 1.7.1 (inclusive) 1.7.2 to 1.7.2 (inclusive) 1.7.3 to 1.7.3 (inclusive) 1.7.3.1 to 1.7.3.1 (inclusive) 1.7.3.2 to 1.7.3.2 (inclusive) 1.7.3.3 to 1.7.3.3 (inclusive)	`1.5.7`	March 17, 2015
CVE-2018-19370	Medium 6.6	3.2%	9.2.0 and earlier	`9.2.0`	November 28, 2018
CVE-2015-2293	Medium 6.8	1.5%	1.5.6 and earlier 1.6.0 to 1.6.0 (inclusive) 1.6.1 to 1.6.1 (inclusive) 1.6.2 to 1.6.2 (inclusive) 1.6.3 to 1.6.3 (inclusive) 1.7.1 to 1.7.1 (inclusive) 1.7.2 to 1.7.2 (inclusive) 1.7.3 to 1.7.3 (inclusive) 1.7.3.1 to 1.7.3.1 (inclusive) 1.7.3.2 to 1.7.3.2 (inclusive) 1.7.3.3 to 1.7.3.3 (inclusive)	`1.5.7`	March 17, 2015
CVE-2021-24153	Medium 5.4	1.1%	Before 3.4.1	`3.4.1`	April 5, 2021
CVE-2012-6692	Medium 4.3	3.2%	2.1.1 and earlier	`2.2`	June 17, 2015
CVE-2017-16842	Medium 4.8	1.3%	Before 5.8.0	`5.8.0`	November 16, 2017
CVE-2024-4984	Medium 6.4	0.6%	0 to 22.6 (inclusive)	`22.7`	May 16, 2024
WF-7d33594b-e7b7-4685-97c1-37a2fecc1b8a	Medium 6.5	—	1.4.6 and earlier	`1.4.7`	August 1, 2014
CVE-2026-15425	Medium 6.4	0.2%	0 to 28.0 (inclusive)	`28.1`	July 25, 2026
CVE-2026-3427	Medium 6.4	0.2%	0 to 27.1.1 (inclusive)	`27.2`	March 22, 2026
CVE-2026-1293	Medium 6.4	0.2%	0 to 26.8 (inclusive)	`26.9`	February 6, 2026
CVE-2024-4041	Medium 6.1	0.8%	0 to 22.5 (inclusive)	`22.6`	May 14, 2024
WF-c0e58807-bccc-469f-82c3-a4bbf088a626	Medium 6.4	—	20.2 and earlier	`20.2.1`	March 2, 2023
WF-2fe34989-493c-4883-a1ca-454262919202	Medium 6.1	—	Before 2.1	`2.1`	April 20, 2015
CVE-2023-40680	Medium 5.5	0.4%	21.0 and earlier	`21.1`	November 24, 2023
WF-a7701dd2-8452-4529-a931-db2553ca1ae5	Medium 5.3	—	3.2.4 and earlier	`3.2.5`	May 6, 2016
WF-48d0e0e0-81db-46ef-ba64-daa2a4079b79	Medium 4.7	—	3.2.5 and earlier	`3.3.0`	June 14, 2016
CVE-2025-14481	Medium 4.3	0.3%	0 to 26.5 (inclusive)	`26.6`	May 27, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.