Which products and versions are affected by CVE-2021-25118?

Affected: Yoast SEO versions >= 16.7; wordpress-seo (wordpress-plugin). The full list is in the CVE brief.

Is CVE-2021-25118 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2021-25118 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2021-25118?

No public exploit code is known.

Is there a fix for CVE-2021-25118?

Fixed versions are available, including wordpress-seo 17.3, Yoast SEO 16.7*, Yoast SEO 17.3.

How urgently should CVE-2021-25118 be patched?

Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Request A Demo

Vulnerability Intelligence

CVE-2021-25118

Medium

Yoast SEO <= 17.2 - Full Path Disclosure

Published Mar 1, 2022 · Updated Sep 8, 2026 · Also known as f162e046-a7d3-4f2c-899d-6c46cb92c8ee

Key Facts

Routine patching

CVE-2021-25118 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting Yoast SEO, wordpress-seo (wordpress-plugin).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 5.6% probability of exploitation in the next 30 days.
Fixed versions are available, including wordpress-seo 17.3, Yoast SEO 16.7*, Yoast SEO 17.3.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

CVSS v3.1

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (30-day exploit likelihood)

5.6%

Higher than 92.8% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2021-25118 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
Yoast SEOYoast	>= 16.7	17.3
wordpress-seowordpress-plugin	See advisory	17.3

Patched Releases

wordpress-seo

17.3

Yoast SEO

16.7*, 17.3

Timeline

Publicly disclosed
Mar 1, 2022
Last updated
Sep 8, 2026

Weakness Type

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

10 more references in the full CVE brief

FAQ

Common Questions.

The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.
Affected: Yoast SEO versions >= 16.7; wordpress-seo (wordpress-plugin). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including wordpress-seo 17.3, Yoast SEO 16.7*, Yoast SEO 17.3.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Is CVE-2021-25118 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.