Threats tagged 'ghsa-6qx8-mxxj-98fc'

The Yoast SEO plugin for WordPress up to and including version 28.0 is vulnerable to a stored cross-site scripting (XSS) flaw via the post slug (post_name). Authenticated users with author-level or higher privileges can inject malicious scripts that execute when other users visit the affected pages. This vulnerability requires pretty permalinks to be enabled, as the exploit depends on how get_permalink() processes the stored post_name. The CVSS score is 6.4, indicating a medium severity impact.