← Vulnerability feed

Vulnerability record · CVE-2021-24153 · published 5 April 2021

CVE-2021-24153: Yoast seo cross-site scripting vulnerability

Yoast · Yoast Seo

A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.

5.4 CVSS 3.1 Medium EPSS 1.1% · top 35.3% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score, v2 3.5
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://packetstormsecurity.com/files/138192/ ExploitThird Party AdvisoryVDB Entry
https://plugins.trac.wordpress.org/changeset/1466243/wordpress-seo Third Party Advisory
https://wpscan.com/vulnerability/77810044-394d-4314-b9a1-20c7dca726dc Third Party Advisory
https://packetstormsecurity.com/files/138192/ ExploitThird Party AdvisoryVDB Entry
https://plugins.trac.wordpress.org/changeset/1466243/wordpress-seo Third Party Advisory
https://wpscan.com/vulnerability/77810044-394d-4314-b9a1-20c7dca726dc Third Party Advisory

Track CVE-2021-24153 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-13478Yoast seo cross-site scripting vulnerabilityThe Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.EPSS 3.3%6.6CVE-2018-19370Yoast seo race condition vulnerabilityA Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordP…EPSS 3.2%6.4CVE-2021-31779Yoast seo server-side request forgery (ssrf) vulnerabilityThe yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.EPSS 0.47%6.1CVE-2023-32300Yoast seo cross-site scripting vulnerabilityUnauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions.EPSS 0.38%5.4CVE-2023-28785Yoast seo cross-site scripting vulnerabilityAuth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.EPSS 0.37%5.4CVE-2021-36788Yoast seo cross-site scripting vulnerabilityThe yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.EPSS 0.47%5.3CVE-2023-28775Yoast seo missing authorization vulnerabilityMissing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.EPSS 0.35%5.3CVE-2021-25118Yoast seo information exposure vulnerabilityThe Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST …EPSS 5.6%

Source: NIST National Vulnerability Database (record CVE-2021-24153), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.