CVE-2015-2293

no score yetEPSS 1.5%

yoast wordpress seo: no CVSS score yet. EPSS 1.5% chance of exploitation in the next 30 days.

Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2015-03-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

yoast:wordpress_seo

References

http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html
http://seclists.org/fulldisclosure/2015/Mar/73
http://www.securitytracker.com/id/1031920
https://wordpress.org/plugins/wordpress-seo/changelog/
https://wpvulndb.com/vulnerabilities/7841

Check your stack JSON