Yoast BV bug bounty programs
yoast.com Updated
Yoast BV runs one public program: a Sorona bug bounty paying up to $2,500.
- Top reward
- $2,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 8
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Yoast BV runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
|
Yoast SEO
Sorona · Bug bounty |
$2,500 | $1,250 | $375 | $188 | $2,500 | Partial | Required | – | Open |
-
- Critical
- $2,500
- High
- $1,250
- Medium
- $375
- Low
- $188
- Safe harbor
- Partial
- KYC
- Required
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
8 targets. 6 excluded.
-
https://yoast.com
Web
-
Import, export and the migration routines that read data written by other SEO plugins
Products and areas
-
The indexable and content-analysis machinery that reads post, term and user data and writes derived records back to the database
Products and areas
-
The plugin's admin surface inside wp-admin: the settings and configuration screens, the post and term metadata editor, and the AJAX and REST routes behind them
Products and areas
-
The public-facing output the plugin serves to anonymous visitors: meta tags, schema and JSON-LD, breadcrumbs, redirects and the XML sitemaps
Products and areas
-
Yoast SEO Free itself, the GPL-2.0-or-later plugin on over ten million WordPress sites, in full
Products and areas
-
Yoast's declaration is one sentence: "The scope of this program is the latest version of Yoast's plugins", with Yoast SEO Free heading the covered list. That is the whole boundary, and it covers the plugins as products rather than a shortlist of features
Products and areas
-
Yoast's other plugins on the same covered list, each at its latest released version
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
A second award for a second symptom, since multiple vulnerabilities caused by one underlying issue are eligible for one reward
-
A write-up at any point, including after the fix ships. Yoast asks that no vulnerability be discussed without express consent, resolved ones included, so there is no automatic release valve
-
Anything not present in the latest released version: the program scopes the latest version only, so a bug already fixed upstream earns nothing
-
Grading disputes: all final decisions are at Yoast's discretion, and the band it assigns is the payout
-
Reports missing a CVSS 3.0 calculation or the email address on a MyYoast account, both of which the program requires before it will grade or pay
-
Third-party plugins that integrate with Yoast, which the program does not cover however the bug reaches a Yoast feature
Recent changes
Reward and scope changes across every Yoast BV program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Yoast BV products, from the NVD.
-
CVE-2023-28775 Medium
Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.
-
CVE-2023-40680 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n/a through 21.0.
-
CVE-2023-28780 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8.
-
CVE-2023-32300 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions.
-
CVE-2023-28785 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.
-
CVE-2017-20092 Low
A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely.
-
CVE-2021-25118 Medium
The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.
-
CVE-2021-36788 Medium
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.
About this page
This page gathers every public program listed under yoast.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.