CVE-2025-11241: CVE-2025-11241: güvenlik açığı

Açıklama (NVD)

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.

Özet bilgiler

CVSS v3.1

6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS

%0,33 (yüzdelik 27)

CWE

CWE-80

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• developer.yoast.com
• sec.stealthcopter.com
• www.wordfence.com
• CWE-80