Yoast SEO 28.1 shipped on 21 July 2026. The free plugin closes an authenticated stored XSS in the post slug; Premium adds AI drafting to the redesigned bulk editor. If you run a multi-author site, both changes matter before the next editorial cycle.
What landed in Yoast SEO 28.1
According to the Yoast SEO Premium changelog, version 28.1 brings AI to the bulk editor. The feature drafts SEO titles, meta descriptions, and social titles and descriptions in bulk, then requires you to review every suggestion before it gets saved. The bulk editor itself got a redesign in the same release.
That review step is not a token checkbox. Bulk edits scale mistakes just as efficiently as they scale fixes. The workflow is: you pick the posts, the AI drafts the fields, and nothing writes to the database until a human approves it. If you have ever pushed a bad title pattern across 400 posts and spent the afternoon reverting it, that gate is the feature.
Who should care about the AI bulk editor
Agencies running content migrations, publishers with large archives, and in-house teams maintaining evergreen libraries are the obvious audience. The bulk editor was already the fastest way to fix titles and descriptions at scale; AI drafting cuts the blank-page time. It does not replace editorial judgment.
Two practical points from the changelog. First, the feature is Premium-only, so free users do not get it. Second, the review requirement is baked into the flow, not buried in a setting. Treat the suggestions as first drafts, not finished copy, and keep a house style guide handy. If you already run ACF Pro to structure your post metadata, the bulk editor is where you reconcile those custom fields with what the AI drafts.
The security fix: CVE-2026-15425
Yoast SEO 28.1 also patches CVE-2026-15425, an authenticated stored XSS via the post slug. The vulnerability affects Yoast SEO up to and including 28.0. Sucuri rates it medium risk in its July 2026 vulnerability patch roundup. The plugin has 10,000,000+ installs.
The attack vector requires Author-level access or higher. That is not a trivial bar, but it is also not the administrator. On multi-author blogs, membership sites, and any install where contributors can create posts, an Author account is often handed out early and monitored rarely. Stored XSS means the payload persists, so a single crafted slug can affect every visitor to the post, including administrators.
What to do:
- Update to Yoast SEO 28.1 or later now. The patch is in the free plugin, not just Premium.
- Audit your user list for Author and Contributor accounts you no longer recognise.
- If you cannot update immediately, review post slugs created by non-admin users and keep an eye on access logs.
- Consider a WAF rule that blocks script tags in slug parameters, but do not treat it as a substitute for patching.
Since 28.1 is the fix, the old advice about a “medium” rating applies: medium on 10 million installs is a large number. The release is the mitigation.
How the release cycle looks from here
Yoast has shipped SEO tooling for WordPress for years, and the 28.x line is doing what the current cycle does across the ecosystem: fold AI into editorial workflows while plugging holes that attackers already know how to find. The AI bulk editor and the XSS patch landed in the same version, which is a useful reminder that “update for the features” and “update for the security” are usually the same action.
If you manage client sites, this is a straightforward maintenance window. Update, verify the plugin still respects your custom wpseo_* filters, and check that the bulk editor drafts are not overwriting any hand-tuned metadata on high-traffic pages. For hosts running staging environments, push the update to staging first; the AI features talk to an external service, so confirm outbound requests are allowed and rate limits are sane before you flip it on for every editor.
FAQ
Is the AI bulk editor available in the free Yoast SEO plugin?
No. The changelog lists it under Yoast SEO Premium 28.1. The free plugin gets the security patch for CVE-2026-15425, but the AI drafting in the bulk editor is a Premium feature.
Does CVE-2026-15425 affect Yoast SEO Premium too?
The advisory covers Yoast SEO up to 28.0, and Premium is built on the same codebase. Yoast SEO Premium 28.1 includes the fix, so updating either edition to 28.1 is the right move.
What is the risk if I do not update right away?
An attacker with an Author-level account can store a script payload in a post slug and execute it in visitors’ browsers. Sucuri rates it medium risk. The exposure is highest on multi-author sites. Update when your change window allows, and audit Author accounts meanwhile.
We conclude: Yoast SEO 28.1 is a maintenance release with a real feature and a real fix. The AI bulk editor saves time if you review what it drafts. The slug XSS patch saves you from a writer account gone wrong. Update both editions, and treat the review step as the point of the feature, not a hurdle to automate away.
