CVE-2026-15425 is a stored cross-site scripting vulnerability in the Yoast SEO – Advanced SEO with real-time guidance and built-in AI WordPress plugin. The flaw arises from insufficient sanitization and escaping of the post slug (post_name) input, allowing authenticated users with author-level access or higher to inject arbitrary scripts. These scripts execute when any user visits the affected page, leveraging the way get_permalink() embeds the percent-encoded post_name in URLs when pretty permalinks are enabled. The vulnerability affects all versions up to and including 28.0.

An attacker with author-level or higher privileges can inject persistent malicious scripts into post slugs, which execute in the context of users visiting the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

No official patch or remediation has been confirmed at this time. Users should monitor the vendor advisory for updates. As a temporary mitigation, restrict author-level access to trusted users only and consider disabling pretty permalinks if feasible, as the exploit depends on them. Avoid using vulnerable versions (<=28.0) once a fix is released.