Skip to content

Yoast BV bug bounty programs

yoast.com Updated

Yoast BV runs one public program: a Sorona bug bounty paying up to $2,500.

Top reward
$2,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Yoast BV runs.

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 6 excluded.

  • https://yoast.com

    Web

  • Import, export and the migration routines that read data written by other SEO plugins

    Products and areas

  • The indexable and content-analysis machinery that reads post, term and user data and writes derived records back to the database

    Products and areas

  • The plugin's admin surface inside wp-admin: the settings and configuration screens, the post and term metadata editor, and the AJAX and REST routes behind them

    Products and areas

  • The public-facing output the plugin serves to anonymous visitors: meta tags, schema and JSON-LD, breadcrumbs, redirects and the XML sitemaps

    Products and areas

  • Yoast SEO Free itself, the GPL-2.0-or-later plugin on over ten million WordPress sites, in full

    Products and areas

  • Yoast's declaration is one sentence: "The scope of this program is the latest version of Yoast's plugins", with Yoast SEO Free heading the covered list. That is the whole boundary, and it covers the plugins as products rather than a shortlist of features

    Products and areas

  • Yoast's other plugins on the same covered list, each at its latest released version

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A second award for a second symptom, since multiple vulnerabilities caused by one underlying issue are eligible for one reward

  • A write-up at any point, including after the fix ships. Yoast asks that no vulnerability be discussed without express consent, resolved ones included, so there is no automatic release valve

  • Anything not present in the latest released version: the program scopes the latest version only, so a bug already fixed upstream earns nothing

  • Grading disputes: all final decisions are at Yoast's discretion, and the band it assigns is the payout

  • Reports missing a CVSS 3.0 calculation or the email address on a MyYoast account, both of which the program requires before it will grade or pay

  • Third-party plugins that integrate with Yoast, which the program does not cover however the bug reaches a Yoast feature

Recent changes

Reward and scope changes across every Yoast BV program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Yoast BV products, from the NVD.

Search NVD
  • Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.

  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n/a through 21.0.

  • Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8.

  • Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions.

  • Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.

  • A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely.

  • The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

  • The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.

About this page

This page gathers every public program listed under yoast.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.