← Vulnerability feed

Vulnerability record · CVE-2019-13478 · published 9 July 2019

CVE-2019-13478: Yoast seo cross-site scripting vulnerability

Yoast · Yoast Seo

The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.

9.8 CVSS 3.1 Critical EPSS 3.3% · top 11.9% CWE-79 · Cross-site scripting
9.8CVSS 3.1 base score, v2 7.5
3.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Yoast/wordpress-seo/releases/tag/11.6-RC5 Release Notes
https://wpvulndb.com/vulnerabilities/9445 Third Party Advisory
https://github.com/Yoast/wordpress-seo/releases/tag/11.6-RC5 Release Notes
https://wpvulndb.com/vulnerabilities/9445 Third Party Advisory

Track CVE-2019-13478 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.6CVE-2018-19370Yoast seo race condition vulnerabilityA Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordP…EPSS 3.2%6.4CVE-2021-31779Yoast seo server-side request forgery (ssrf) vulnerabilityThe yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.EPSS 0.47%6.1CVE-2023-32300Yoast seo cross-site scripting vulnerabilityUnauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions.EPSS 0.38%5.4CVE-2023-28785Yoast seo cross-site scripting vulnerabilityAuth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.EPSS 0.37%5.4CVE-2021-36788Yoast seo cross-site scripting vulnerabilityThe yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.EPSS 0.47%5.4CVE-2021-24153Yoast seo cross-site scripting vulnerabilityA Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which…EPSS 1.1%5.3CVE-2023-28775Yoast seo missing authorization vulnerabilityMissing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.EPSS 0.35%5.3CVE-2021-25118Yoast seo information exposure vulnerabilityThe Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST …EPSS 5.6%

Source: NIST National Vulnerability Database (record CVE-2019-13478), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.