← Vulnerability feed

Vulnerability record · CVE-2021-31779 · published 28 April 2021

CVE-2021-31779: Yoast seo server-side request forgery (ssrf) vulnerability

Yoast · Yoast Seo

The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.

6.4 CVSS 3.1 Medium EPSS 0.47% · top 61.4% CWE-918 · Server-side request forgery (SSRF)
6.4CVSS 3.1 base score, v2 5.5
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://typo3.org/security/advisory/typo3-ext-sa-2021-006 PatchThird Party Advisory
https://typo3.org/security/advisory/typo3-ext-sa-2021-006 PatchThird Party Advisory

Track CVE-2021-31779 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-13478Yoast seo cross-site scripting vulnerabilityThe Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.EPSS 3.3%6.6CVE-2018-19370Yoast seo race condition vulnerabilityA Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordP…EPSS 3.2%6.1CVE-2023-32300Yoast seo cross-site scripting vulnerabilityUnauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions.EPSS 0.38%5.4CVE-2023-28785Yoast seo cross-site scripting vulnerabilityAuth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.EPSS 0.37%5.4CVE-2021-36788Yoast seo cross-site scripting vulnerabilityThe yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.EPSS 0.47%5.4CVE-2021-24153Yoast seo cross-site scripting vulnerabilityA Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which…EPSS 1.1%5.3CVE-2023-28775Yoast seo missing authorization vulnerabilityMissing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.EPSS 0.35%5.3CVE-2021-25118Yoast seo information exposure vulnerabilityThe Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST …EPSS 5.6%

Source: NIST National Vulnerability Database (record CVE-2021-31779), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.