Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wordpress-seo-premium
Yoast SEO Premium
4 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 2, 2026Yoast SEO Premium: Does not sanitize control characters from redirect origins before writing them to the site's Apache configuration fileCVE-2026-10821 · fixed in 27.6.1 · reported by WPScanMedium 6.6
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
Jun 17, 2026Yoast SEO Premium: Missing AuthorizationCVE-2026-40722 · affects up to 26.6 · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6.
Oct 2, 2025Yoast SEO Premium: Stored Cross-Site ScriptingCVE-2025-11241 · affects 25.7 to 25.9 · reported by WordfenceMedium 6.4
The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.
Jun 11, 2024Yoast SEO Premium: Missing AuthorizationCVE-2023-28775 · affects up to 20.4 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.