Two safety vulnerabilities have been disclosed within the All in One search engine optimization WordPress plugin, which has over two million lively installations. Each vulnerabilities allow unauthenticated attackers to execute arbitrary shortcodes or inject malicious scripts underneath particular situations.
All In One search engine optimization WordPress Plugin
The All in One search engine optimization (AIOSEO) WordPress plugin is a well-liked search engine optimization plugin utilized by over 2 million customers. It’s used to handle search engine marketing settings on WordPress web sites. It additionally supplies instruments for managing XML sitemaps, structured information, redirects, inside hyperlinks and content material optimization. The plugin additionally contains instruments for monitoring search rankings, auditing web site search engine optimization and producing content material with AI.
CVE-2026-100152 Unauthenticated Arbitrary Shortcode Execution Vulnerability
The primary vulnerability, rated 6.5 (Medium), impacts all variations of AIOSEO as much as and together with 5.0.2. It permits unauthenticated attackers to execute arbitrary WordPress shortcodes when particular situations are met.
What makes this vulnerability regarding is that attackers don’t want an account on the web site or any degree of consumer privileges to take advantage of it.
The vulnerability is attributable to a lacking validation verify earlier than the plugin runs the WordPress `do_shortcode` perform.
Shortcodes are directions that inform WordPress to carry out particular capabilities, similar to displaying content material or working a function. The `do_shortcode` perform processes these directions.
The safety weak spot is that the plugin doesn’t correctly verify a price earlier than executing a shortcode, which makes it attainable for an attacker to trigger the web site to execute arbitrary shortcodes.
In response to Wordfence:
“This makes it attainable for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search outcomes web page by way of the block, widget, shortcode, or template tag.”
That final half is a crucial limitation as a result of the vulnerability requires AIOSEO breadcrumbs to seem on a WordPress search outcomes web page.
Breadcrumbs are the navigation hyperlinks that present guests the place a web page is positioned inside an internet site. The vulnerability could be exploited when these breadcrumbs are displayed on search outcomes pages utilizing one of many strategies recognized by Wordfence.
Which means though attackers don’t must log in, the vulnerability depends upon how the web site makes use of the plugin’s breadcrumb function.
CVE-2026-85492 Unauthenticated XSS Vulnerability
The second vulnerability, rated 6.1 (Medium), is a DOM-based Cross-Web site Scripting (XSS) vulnerability that impacts all variations as much as and together with 5.0.1.1.
This vulnerability additionally includes unauthenticated attackers, however exploitation requires a licensed WordPress consumer to take particular actions.
The safety weak spot is attributable to inadequate enter sanitization and output escaping within the dealing with of a URL pathname.
Enter sanitization and output escaping are safety measures used to forestall untrusted data from being handled as executable code. On this case, the lacking protections permit attackers to insert malicious scripts right into a specifically constructed URL.
Wordfence explains:
“This makes it attainable for unauthenticated attackers to inject arbitrary net scripts in pages that can execute each time a consumer visits a crafted URL. Exploitation requires the sufferer to carry the aioseo_manage_seo functionality and to open the search engine optimization Preview panel within the WordPress admin toolbar whereas visiting a web page with a malicious payload embedded within the URL pathname.”
What makes this vulnerability harder to take advantage of is that visiting the malicious URL alone just isn’t enough.
The focused consumer should have the `aioseo_manage_seo` functionality, which is a WordPress permission related to managing search engine optimization options. That consumer should additionally open the plugin’s search engine optimization Preview panel from the WordPress admin toolbar whereas visiting the malicious URL.
DOM-based XSS implies that the malicious script executes within the consumer’s net browser. The vulnerability due to this fact depends upon the actions of a consumer with the required search engine optimization permission reasonably than permitting an attacker to execute the script just by accessing the web site.
Each Vulnerabilities Are Patched
Each vulnerabilities have been patched in separate releases of the All in One search engine optimization plugin.
CVE-2026-85492
Model 5.0.2 addresses the cross-site scripting vulnerability. The plugin’s changelog describes the safety enhancements:
“Fastened: Improved safety and entry protections in search engine optimization Revisions, search engine optimization Evaluation and the search engine optimization Preview.”
CVE-2026-100152
Model 5.0.2.1 fixes the arbitrary shortcode execution vulnerability.
The changelog describes the replace:
“Fastened: Improved safety protections for shortcodes on search pages.”
Customers of the All in One search engine optimization WordPress plugin are advisable to replace to model 5.0.2.1 or a more moderen patched model to guard in opposition to each vulnerabilities.
Featured Picture by Shutterstock/Andrei Korzhyts
