TI-2021-06445 Aliases CVE-2021-24153 GHSA-qj4c-xvxc-5hqj

Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)

LOW 27CWE-79Published 2021-04-05 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.

Why it matters now

EPSS 0.01115 66th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Yoast SEO (Unknown): 3.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Yoast SEO	3.4.1 to before 3.4.1	3.4.1	Patch available	CNA

Yoast SEO VendorUnknown Affected 3.4.1 to before 3.4.1 Fixed in 3.4.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:yoast:yoast_seo::::::wordpress::*	before 3.4.1	Vulnerable	Yoast

cpe:2.3:a:yoast:yoast_seo:*:*:*:*:*:wordpress:*:* Versions before 3.4.1 Vulnerable ·Yoast

Remediation

Fix · CNA Yoast SEO (Unknown) Fixed in 3.4.1

Timeline

2026-10-02 Threatist record created from CVE-2021-24153
2026-10-03 Alias added: GHSA-qj4c-xvxc-5hqj

References

Exploit 1

https://packetstormsecurity.com/files/138192/

Advisory 2

TI-2019-10120 The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions. CVSS 3.1CRITICAL 9.8
TI-2018-13725 A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in… CVSS 3.0MEDIUM 6.6
TI-2021-07396 Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure CVSS 3.1MEDIUM 5.3
TI-2023-15596 WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
TI-2023-13285 WordPress Yoast SEO Premium plugin <= 20.4 - Unauthenticated Zapier API Key Reset vulnerability CVSS 3.1MEDIUM 5.3
TI-2023-13295 WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences