CVE-2026-15425 is a stored Cross-Site Scripting vulnerability in the Yoast SEO – Advanced SEO with real-time guidance and built-in AI WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the post slug (post_name) in all versions up to and including 28.0. Authenticated attackers with author-level privileges or higher can inject arbitrary web scripts into pages, which execute when users access those pages. The exploit depends on pretty permalinks being enabled, as the get_permalink() function embeds the stored percent-encoded post_name in the generated URL, facilitating script execution.

An attacker with author-level access or higher can inject malicious scripts into post slugs, leading to stored XSS that executes in the context of users visiting the affected pages. This can result in information disclosure or session hijacking. The vulnerability does not affect availability and requires authentication with specific privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling pretty permalinks if feasible to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.