CVE-2026-3427 is a stored cross-site scripting vulnerability in the Yoast SEO – Advanced SEO with real-time guidance and built-in AI WordPress plugin. The issue exists in all versions up to and including 27.1.1 due to improper neutralization of input in the jsonText block attribute. Authenticated attackers with Contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4, reflecting a medium impact on confidentiality and integrity without affecting availability.

Successful exploitation allows authenticated users with Contributor-level access or above to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The impact affects confidentiality and integrity but does not impact availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider monitoring or reviewing content submitted by such users for suspicious input. Avoid granting Contributor or higher privileges to untrusted users. Follow updates from Yoast for any released patches or official mitigations.