Do Son Censys research finds 70% of WordPress sites run end-of-life PHP. Outdated plugins and defaults leave millions of sites wide open to attack.
Yoast SEO
Yoast SEO Premium has a stored XSS flaw (CVE-2025-11241) that allows Contributor+ users to inject malicious scripts into posts. All users are urged to upgrade to v26.0 immediately.
CVE-2024-4984 could allow malicious actors to inject harmful scripts into websites, potentially compromising visitor data, redirecting traffic
The CVE-2024-4041 vulnerability stems from insufficient input sanitization and output escaping mechanisms within the plugin