Yoast SEO

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical │ $2,000 │ $2,500 High │ $1,000 │ $1,250 Medium │ $300 │ $375 Low │ $150 │ $188 Informative (published as a dash) │ no reward │ no reward Submit a vulnerability CVE history 13 Last 12 months 32 Lifetime XSS 55 % Access control 20 % Info disclosure 15 % Injection 5 % Latest advisories Loading the feed Overview Yoast SEO is the WordPress SEO plugin, with over ten million active installations according to the WordPress.org plugin API: one of the top handful of plugins in the world by install base. Every one of those installs is a self-hosted WordPress site rather than a seat in a vendor's data centre, so the footprint is genuinely distributed and a plugin defect is reachable on millions of independently administered sites the moment it ships. The free plugin is GPL-2.0-or-later and is the first product named in the program's own covered list, so the open-source asset here is the one carrying the install base rather than a side project. Yoast BV pays directly on a published table: $2,000 for a Critical, $1,000 for a High, $300 for a Medium and $150 for a Low, graded on a CVSS 3.0 calculation the reporter has to supply. One condition deserves attention before you start: Yoast asks that vulnerabilities not be discussed without its express consent, and the parenthetical "even resolved ones" removes the usual post-fix release valve, so this is perpetual consent-gated silence rather than a bounded embargo. sorona.xyz adds 1.25× on top of whatever Yoast awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Yoast's declaration is one sentence: "The scope of this program is the latest version of Yoast's plugins", with Yoast SEO Free heading the covered list. That is the whole boundary, and it covers the plugins as products rather than a shortlist of features Yoast SEO Free itself, the GPL-2.0-or-later plugin on over ten million WordPress sites, in full The plugin's admin surface inside wp-admin: the settings and configuration screens, the post and term metadata editor, and the AJAX and REST routes behind them The indexable and content-analysis machinery that reads post, term and user data and writes derived records back to the database The public-facing output the plugin serves to anonymous visitors: meta tags, schema and JSON-LD, breadcrumbs, redirects and the XML sitemaps Import, export and the migration routines that read data written by other SEO plugins Yoast's other plugins on the same covered list, each at its latest released version Out of scope Third-party plugins that integrate with Yoast, which the program does not cover however the bug reaches a Yoast feature Anything not present in the latest released version: the program scopes the latest version only, so a bug already fixed upstream earns nothing A second award for a second symptom, since multiple vulnerabilities caused by one underlying issue are eligible for one reward Reports missing a CVSS 3.0 calculation or the email address on a MyYoast account, both of which the program requires before it will grade or pay Grading disputes: all final decisions are at Yoast's discretion, and the band it assigns is the payout A write-up at any point, including after the fix ships. Yoast asks that no vulnerability be discussed without express consent, resolved ones included, so there is no automatic release valve Most-valued findings Stored or reflected cross-site scripting that fires inside a wp-admin session. XSS is 55% of Yoast's published advisory history and by a wide margin the class this program actually sees. A payload stored through a Yoast settings or metadata field and executed for a logged-in administrator is the shape that reaches the $2,000 Critical row Access-control failures on Yoast's REST routes, AJAX handlers and nonce checks that let a subscriber-level or unauthenticated visitor reach an action meant for an editor or an administrator. That is the 20% class, and the one that turns a low-privilege account into site control Anything demonstrated on Yoast SEO Free rather than on a paid add-on, since the free plugin carries the ten-million-install base and the identical defect in Premium reaches a small fraction of those sites Information disclosure through the indexable and sitemap machinery that exposes draft, private, scheduled or otherwise non-public content to an anonymous visitor Injection into the paths where Yoast writes to or reads from the database, since a plugin running on every request has no meaningful privilege boundary against WordPress itself once it is executing Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Supply a CVSS 3.0 calculation with the report, using the calculator: the band you compute is what drives the payout Give the email address on your MyYoast account, so an account in your own name is effectively required to be paid Only the latest version of each plugin is in scope; a bug already fixed in a newer release earns nothing Multiple vulnerabilities caused by one underlying issue will only be eligible for one reward All final decisions are at the discretion of Yoast Yoast asks that no vulnerability be discussed without its express consent, including resolved ones, and that request carries no expiry date Disclosure Coordinated privately with [email protected] . Yoast's own request is not a fixed-clock embargo but an open-ended one: it asks that vulnerabilities not be discussed without express consent, even after they are fixed, so there is no point at which publication becomes automatic. File with Yoast first, get consent in writing before any write-up, and sorona.xyz holds your finding until then. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability