CVE-2024-4984:Yoast SEO <= 22.6 suffers from a stored Cross-Site Scripting (XSS) vulnerability via the author display_name, exploitable by authenticated attackers with contributor-level access or higher; a fix is available in the 22.7 release.

splash
Back

Description Preview

Yoast SEO for WordPress versions up to and including 22.6 is vulnerable to stored XSS through the display_name value in author metadata. The root cause is insufficient input sanitization and output escaping for the author meta, which allows an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into pages. When other users visit a page that includes the injected content, the script executes in their browser, creating potential for cookie theft, session hijacking, or defacement. This vulnerability is tracked as CVE-2024-4984, with a CVSS v3.1 base score of 6.4 (Medium). The issue was discovered in late April 2024 and disclosed in mid-May 2024. A patch addressing this flaw was released in Yoast SEO 22.7. References to the related GitHub pull request, WordPress Trac changeset, and Yoast changelog confirm the fix and its deployment.

Overview

This CVE describes a stored XSS vulnerability in Yoast SEO for WordPress (≤ 22.6) where the author display_name is not properly sanitized or escaped, enabling an authenticated attacker with contributor privileges to inject script into pages that execute when viewed by users. The vulnerability affects all versions up to 22.6 and has a medium severity (CVSS v3.1 base score 6.4). The issue was disclosed by Wordfence and subsequently patched in the 22.7 release, with references documenting the fix and associated development activity.

Remediation

  • Update Yoast SEO to version 22.7 or newer (install the official patch that fixes the input sanitization and output escaping for author metadata).
  • Ensure WordPress core and all plugins/themes are up to date to minimize exposure to related issues.
  • If an immediate update is not possible, restrict contributor-level access or limit permissions that allow editing author display_name until a patch can be applied.
  • Validate and sanitize author-related fields on intake and implement additional server-side checks where feasible.
  • After applying the patch, verify the fix in a staging environment by attempting to inject script via author display_name and confirming no script execution on loaded pages.
  • Enable or strengthen Web Application Firewall (WAF) rules and monitor for suspicious activity related to author metadata changes.

References

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  2. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  3. Public Administration: Low
    Public Administration
  4. Finance and Insurance: Low
    Finance and Insurance
  5. Health Care & Social Assistance: Low
    Health Care & Social Assistance
  6. Manufacturing: Low
    Manufacturing
  7. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  8. Transportation & Warehousing: Low
    Transportation & Warehousing
  9. Accommodation & Food Services: Low
    Accommodation & Food Services
  10. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  11. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  12. Construction: Low
    Construction
  13. Educational Services: Low
    Educational Services
  14. Information: Low
    Information
  15. Mining: Low
    Mining
  16. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  17. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  18. Retail Trade: Low
    Retail Trade
  19. Utilities: Low
    Utilities
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background