CVE-2021-25118

5.3 mediumEPSS 5.6%

Medium (5.3) in yoast yoast seo. EPSS 5.6% chance of exploitation in the next 30 days.

The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 5.6% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2022-02-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

yoast:yoast_seo

References

https://plugins.trac.wordpress.org/changeset/2608691
https://wpscan.com/vulnerability/2c3f9038-632d-40ef-a099-6ea202efb550
https://plugins.trac.wordpress.org/changeset/2608691
https://wpscan.com/vulnerability/2c3f9038-632d-40ef-a099-6ea202efb550

Check your stack JSON