Two safety vulnerabilities were disclosed in the All in One SEO WordPress plugin, which has complete two myriad energetic installations. Both vulnerabilities allow unauthenticated attackers to execute arbitrary shortcodes or inject malicious scripts under particular conditions.
All In One SEO WordPress Plugin
The All in One SEO (AIOSEO) WordPress plugin is a famous SEO plugin used by complete 2 myriad users. It’s used to oversee hunt motor optimization settings on WordPress websites. It additionally provides tools for managing XML sitemaps, organized data, redirects, inner links and satisfied optimization. The plugin additionally includes tools for monitoring hunt rankings, auditing website SEO and generating satisfied alongside AI.
CVE-2026-100152 Unauthenticated Arbitrary Shortcode Execution Vulnerability
The archetypal vulnerability, rated 6.5 (Medium), affects all versions of AIOSEO up to and including 5.0.2. It enables unauthenticated attackers to execute arbitrary WordPress shortcodes whenever particular conditions are met.
What makes this exposure concerning is that attackers don’t need an document on the website or any flat of person privileges to utilize it.
The exposure is caused by a missing validation inspect before the plugin runs the WordPress `do_shortcode` function.
Shortcodes are instructions that inform WordPress to execute particular functions, specified as displaying satisfied or operating a feature. The `do_shortcode` function processes those instructions.
The safety weakness is that the plugin doesn’t correctly inspect a value before executing a shortcode, which makes it imaginable for an attacker to logic the website to execute arbitrary shortcodes.
According to Wordfence:
“This makes it imaginable for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the hunt results leaf via the block, widget, shortcode, or template tag.”
That final part is an crucial limitation since the exposure requires AIOSEO breadcrumbs to appear on a WordPress hunt results page.
Breadcrumbs are the navigation links that display visitors anywhere a leaf is located inside a website. The exposure can be exploited whenever those breadcrumbs are displayed on hunt results pages using among the methods identified by Wordfence.
This method that although attackers don’t need to log in, the exposure depends on how the website uses the plugin’s breadcrumb feature.
CVE-2026-85492 Unauthenticated XSS Vulnerability
The second vulnerability, rated 6.1 (Medium), is a DOM-based Cross-Site Scripting (XSS) exposure that affects all versions up to and including 5.0.1.1.
This exposure additionally involves unauthenticated attackers, but exploitation requires an authorized WordPress person to obtain particular actions.
The safety weakness is caused by insufficient input sanitization and output escaping in the handling of a URL pathname.
Input sanitization and output escaping are safety measures used to forestall untrusted data from being treated as executable code. In this case, the missing protections authorize attackers to insert malicious scripts into a specially constructed URL.
Wordfence explains:
“This makes it imaginable for unauthenticated attackers to inject arbitrary web scripts in pages that volition execute whenever a person visits a crafted URL. Exploitation requires the casualty to clasp the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar during visiting a leaf alongside a malicious payload embedded in the URL pathname.”
What makes this exposure additional difficult to utilize is that visiting the malicious URL solitary is not sufficient.
The targeted person must have the `aioseo_manage_seo` capability, which is a WordPress approval connected alongside managing SEO features. That person must additionally open the plugin’s SEO Preview panel from the WordPress admin toolbar during visiting the malicious URL.
DOM-based XSS method that the malicious manuscript executes in the user’s web browser. The exposure hence depends on the actions of a person alongside the required SEO approval fairly than allowing an attacker to execute the manuscript merely by accessing the website.
Both Vulnerabilities Are Patched
Both vulnerabilities have been patched in distinct releases of the All in One SEO plugin.
CVE-2026-85492
Version 5.0.2 addresses the cross-site scripting vulnerability. The plugin’s changelog describes the safety improvements:
“Fixed: Improved safety and admission protections in SEO Revisions, SEO Analysis and the SEO Preview.”
CVE-2026-100152
Version 5.0.2.1 fixes the arbitrary shortcode implementation vulnerability.
The changelog describes the update:
“Fixed: Improved safety protections for shortcodes on hunt pages.”
Users of the All in One SEO WordPress plugin are recommended to update to type 5.0.2.1 or a newer patched type to defend against the two vulnerabilities.
Featured Image by Shutterstock/Andrei Korzhyts
