CVE-2026-57764: XSS Vulnerability in Yoast SEO Breadcrumb Shortcode Plugin (v1.2) – Patch Guidance

Technical summary

CVE-2026-57764 is a stored XSS vulnerability (CWE-79) in the Surbma Yoast SEO Breadcrumb Shortcode plugin affecting versions 1.2 and below. The plugin fails to properly sanitize and validate user input in breadcrumb shortcode parameters before rendering them in the frontend. An authenticated contributor or higher-privileged user can inject arbitrary HTML and JavaScript through shortcode attributes. Because the payload persists in the database and executes in the context of all site visitors, this constitutes a stored XSS condition with cross-site implications (CVSS vector S:C indicates changed scope). The vulnerability requires authentication and user interaction but can compromise multiple site visitors and their interactions.

Business impact

Organizations running WordPress with this plugin face exposure to credential theft, session hijacking, and malware distribution to site visitors. If the affected site serves customers, partners, or internal stakeholders, attackers can harvest sensitive information or redirect users to phishing pages. The attack requires an insider (contributor or editor), so the risk is elevated in multi-author environments or where contributor accounts are shared or compromised. Reputational damage from a visitor-facing XSS attack can undermine customer trust.

Affected systems

WordPress installations using the Surbma Yoast SEO Breadcrumb Shortcode plugin in version 1.2 or earlier are affected. The plugin name and vendor indicate this is a third-party addon for WordPress, not part of Yoast's official SEO suite. Any WordPress site with this plugin installed and with users holding contributor, author, or editor roles is at risk. Multisite WordPress installations may be partially affected depending on plugin activation scope.

Exploitability

Exploitation requires valid WordPress authentication (contributor level or above) and user interaction—a victim must view a page containing the malicious breadcrumb. This narrows the attack surface to insider threats or scenarios where contributor accounts are compromised. However, the barrier to weaponization is low once access is obtained; no special tools or complex payload construction is needed. The CVSS score of 6.5 (Medium) reflects this balance: authentication is required, but the scope is changed and multiple integrity/confidentiality/availability impacts are possible.

Remediation

Update the Surbma Yoast SEO Breadcrumb Shortcode plugin to a version newer than 1.2 as soon as the developer releases a patch. Verify the fix addresses input sanitization and output encoding in breadcrumb shortcode rendering. As an interim measure, restrict contributor role capabilities or disable the shortcode feature if not actively used. Review contributor account permissions and audit recent posts/pages for suspicious breadcrumb modifications. Consider using WordPress security plugins to monitor shortcode usage and alert on unusual post revisions.

Patch guidance

Check the official WordPress plugin repository or the vendor's site for available updates beyond version 1.2. Apply the update through the WordPress admin dashboard or via command line (wp plugin update) in a staging environment first. Test breadcrumb display and shortcode functionality after patching. If no patch is available from the vendor, evaluate alternative breadcrumb plugins with better maintenance records and security practices. Verify patch details against the vendor advisory to confirm XSS mitigation was included.

Detection guidance

Monitor WordPress post and page revisions for suspicious modifications to breadcrumb shortcodes, especially by lower-privileged users. Use WordPress security plugins or log monitoring to flag posts containing script tags or suspicious attributes in shortcode parameters. Check web server logs for unusual patterns in requests containing encoded payloads (e.g., %3Cscript%3E). Review contributor account activity during the window between plugin installation and patch deployment. Client-side detection: monitor browser developer console for unexpected JavaScript execution on pages using the breadcrumb shortcode, and look for unauthorized cookies or local storage access.

Why prioritize this

Although CVSS severity is Medium, prioritize patching in any environment where multiple contributors or editors have access, or where the WordPress site is customer-facing. The insider threat component and potential for broad visitor impact justify faster remediation than the score alone suggests. If your organization has strict code review or content approval workflows, risk is lower; if not, elevate priority. Zero-day status and lack of known in-the-wild exploitation (KEV not listed) mean you have time to test and deploy carefully rather than emergencies, but do not delay.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) factors in: (1) Network-accessible attack vector—exploitable remotely over HTTP/HTTPS; (2) Low attack complexity—no special conditions required; (3) Low privilege requirement—contributor role is commonly granted; (4) Required user interaction—victim must visit the affected page; (5) Changed scope—XSS can affect other users and site functionality; (6) Low impact to confidentiality, integrity, and availability—credential theft and session hijacking are possible but limited by browser security policies. The score reflects a real but contained threat; organizations should not dismiss it as insignificant.

Frequently asked questions