Vulnerabilities > Yoast > Yoast SEO > Medium

DATE CVE VULNERABILITY TITLE RISK
2024-06-11 CVE-2023-28775 Missing Authorization vulnerability in Yoast SEO
Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.
network
low complexity
yoast CWE-862
5.3
2023-11-30 CVE-2023-40680 Cross-site Scripting vulnerability in Yoast SEO
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n/a through 21.0.
network
low complexity
yoast CWE-79
4.8
2023-08-23 CVE-2023-32300 Cross-site Scripting vulnerability in Yoast SEO
Unauth.
network
low complexity
yoast CWE-79
6.1
2023-05-28 CVE-2023-28785 Cross-site Scripting vulnerability in Yoast SEO
Auth.
network
low complexity
yoast CWE-79
5.4
2022-02-28 CVE-2021-25118 Information Exposure vulnerability in Yoast SEO
The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.
network
low complexity
yoast CWE-200
5.3
2021-04-28 CVE-2021-31779 Server-Side Request Forgery (SSRF) vulnerability in Yoast SEO 7.2.0
The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
network
low complexity
yoast CWE-918
5.5
2018-11-28 CVE-2018-19370 Race Condition vulnerability in Yoast SEO
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
network
yoast CWE-362
6.0