1. SEJ
  2.  ⋅ 
  3. WordPress

Yoast SEO Plugin Bug Inserts Hidden AI HTML Code

Yoast pushed out an emergency fix after users discovered that its plugin was leaking AI-related code into WordPress content.

Yoast SEO Plugin Bug Inserts Hidden AI HTML Code

Yoast SEO rushed out an update to fix a bug in Yoast Premium that introduced a known fingerprint of AI-generated content. The bug was highlighted on social media, and Yoast corrected the error within hours.

HTML Attributes Can Be Injected By Copy-Pasting

Copying a block of text from a live web page or even a Microsoft Word document and then pasting it into a WordPress editor will also paste the underlying formatting from the original document. That’s basically the reason why copy-pasting content directly from ChatGPT and into a WordPress editor will also inject HTML “classes” code from an AI chatbot output.

An HTML “attribute” is something that’s added to an HTML element. A paragraph element <p> can have an attribute like a “class” attribute, which can then be used to attach a style to it, like specifying a font.

This bug introduces an attribute into the HTML that looks like this:

 data-start=

and

data-end=

This bug can be reproduced with ChatGPT when a user highlights generated text, copies it, then pastes it into the WordPress editor. The HTML attributes injected into the content by Yoast Premium are only visible within the code, not on the published content.

This is what AI-generated content looks like with injected classes:

“He thought no one would notice—<br data-start=”31″ data-end=”34″ />the quiet hum of the AI<br data-start=”57″ data-end=”60″ />churning out words<br data-start=”78″ data-end=”81″ />like it knew something.<br data-start=”104″ data-end=”107″ />Google noticed.<br data-start=”122″ data-end=”125″ />Now he shelves canned beans at Safeway.”

This is what the content would look like in the visible version:

“He thought no one would notice—
the quiet hum of the AI
churning out words
like it knew something.
Google noticed.
Now he shelves canned beans at Safeway.”

The “data-start” and “data-end” classes are the telltale clues that the content was generated by AI. Unrelated to the Yoast bug, SEOs have over the past weeks been talking about noticing these artifacts and have added identifying them as part of their SEO audits.

Yoast SEO Premium Injects AI Attributes

Alan Bleiweiss, known for content audits, called attention to the fact that Yoast SEO was injecting the “data-start” and “data-end” HTML attributes into the content. Alan called them “wrappers” but they’re technically HTML attributes, similar to CSS classes.

He posted:

“UPDATE

Yoast Plug-in pushed live without proper QA. Injecting AI wrappers without site owner permission.

Fortunately, according to Carolyn Shelby they’re working on a fix.

But tool providers need to do better.”

Alan indicated that no clarification was given as to how those attributes were injected but the bug was limited to Yoast SEO Premium because the free version does not contain the necessary AI text generation feature (Yoast AI Optimize).

Yoast Pushes Update To Fix Bug

Yoast swiftly pushed an update, version 25.3.1, to fix the issue so that AI-generated content created by Yoast SEO Premium does not contain the classes. Happily, the updated plugin also removes the telltale HTML attributes.

According to the Yoast SEO blog post announcement:

“Recently, we announced the rollout of Yoast AI Optimize for the Classic Editor in WordPress. …During the initial rollout, we discovered a technical issue where unintended classes were being added to content for some users. While these added classes are harmless and do not impact the functionality or appearance of your content, they should not have been added, that’s on us.

We take this seriously, and to maintain the quality you expect, we’ve been actively working on a solution. We’re pleased to share that a fix has now been released, and the issue has been resolved. For users already affected, we are automatically cleaning up the unintended classes as part of the fix, no action is needed on your part.”

The functionality was rolled out on June 2nd, which means that sites with affected content have been out there for at most two weeks.

The free version of the plugin has also been updated. The changelog offers this explanation:

“This is a maintenance release which is required to align with changes to Yoast SEO Premium 25.3.1.”

Can This Have Impacted Rankings?

It’s probably unlikely that this has affected rankings but at this point it’s unknown if Google would have noticed.  Google would have to specifically look for those classes which in themselves do not indicate anything about content quality. So again, it’s probably unlikely that this bug had an effect on search rankings.

Nevertheless users of the premium version of the Yoast SEO Plugin should update immediately to version 25.3.1 to fix any potential issues from this bug and users of the free version should update their versions as well, even though it’s not affected.

Could Buggy Release Have Been Prevented?

Yoast SEO plugin is a trustworthy plugin with a long history of no major vulnerabilities.  But changes to the content, site structure, and the underlying HTML should be something that all plugin developers check for before releasing a plugin to users.

This is especially true for the developers of the Yoast SEO plugin, because they have prior experience pushing out a troubled update that caused discernible changes to a website.

  • Yoast SEO published an update in March 2022 that created duplicate sitemaps.
  • In March 2018, Yoast SEO published a buggy update that created hundreds to thousands of thin pages, one page for each image uploaded to a website. That last issue went undetected for three months, as SEOs gradually began noticing thousands of new pages being generated.

This then is at least the third time that Yoast has pushed a buggy update (but it was limited to Yoast SEO Premium) that could have been avoided if they had tested the plugin before pushing it live. All it takes is to check whether a test site remains the same before and after an update. Given the stakes with AI-generated content, the output of the generated content and the underlying code is something that should have been tested.

Featured Image by Shutterstock/Jihan Nafiaa Zahri

Category News SEO WordPress
SEJ STAFF Roger Montti Owner - Martinibuster.com at Martinibuster.com

I have 25 years hands-on experience in SEO, evolving along with the search engines by keeping up with the latest ...

OSZAR »