Two security vulnerabilities were disclosed in the All in One SEO WordPress plugin, which has over two million active installations. Both vulnerabilities enable unauthenticated attackers to execute arbitrary shortcodes or inject malicious scripts under specific conditions.
All In One SEO WordPress Plugin
The All in One SEO (AIOSEO) WordPress plugin is a popular SEO plugin used by over 2 million users. It’s used to manage search engine optimization settings on WordPress websites. It also provides tools for managing XML sitemaps, structured data, redirects, internal links and content optimization. The plugin also includes tools for monitoring search rankings, auditing website SEO and generating content with AI.
CVE-2026-100152 Unauthenticated Arbitrary Shortcode Execution Vulnerability
The first vulnerability, rated 6.5 (Medium), affects all versions of AIOSEO up to and including 5.0.2. It enables unauthenticated attackers to execute arbitrary WordPress shortcodes when specific conditions are met.
What makes this vulnerability concerning is that attackers don’t need an account on the website or any level of user privileges to exploit it.
The vulnerability is caused by a missing validation check before the plugin runs the WordPress `do_shortcode` function.
Shortcodes are instructions that tell WordPress to perform specific functions, such as displaying content or running a feature. The `do_shortcode` function processes those instructions.
The security weakness is that the plugin doesn’t properly check a value before executing a shortcode, which makes it possible for an attacker to cause the website to execute arbitrary shortcodes.
According to Wordfence:
“This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag.”
That last part is an important limitation because the vulnerability requires AIOSEO breadcrumbs to appear on a WordPress search results page.
Breadcrumbs are the navigation links that show visitors where a page is located within a website. The vulnerability can be exploited when those breadcrumbs are displayed on search results pages using one of the methods identified by Wordfence.
This means that although attackers don’t need to log in, the vulnerability depends on how the website uses the plugin’s breadcrumb feature.
CVE-2026-85492 Unauthenticated XSS Vulnerability
The second vulnerability, rated 6.1 (Medium), is a DOM-based Cross-Site Scripting (XSS) vulnerability that affects all versions up to and including 5.0.1.1.
This vulnerability also involves unauthenticated attackers, but exploitation requires an authorized WordPress user to take specific actions.
The security weakness is caused by insufficient input sanitization and output escaping in the handling of a URL pathname.
Input sanitization and output escaping are security measures used to prevent untrusted information from being treated as executable code. In this case, the missing protections allow attackers to insert malicious scripts into a specially constructed URL.
Wordfence explains:
“This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname.”
What makes this vulnerability more difficult to exploit is that visiting the malicious URL alone is not sufficient.
The targeted user must have the `aioseo_manage_seo` capability, which is a WordPress permission associated with managing SEO features. That user must also open the plugin’s SEO Preview panel from the WordPress admin toolbar while visiting the malicious URL.
DOM-based XSS means that the malicious script executes in the user’s web browser. The vulnerability therefore depends on the actions of a user with the required SEO permission rather than allowing an attacker to execute the script simply by accessing the website.
Both Vulnerabilities Are Patched
Both vulnerabilities have been patched in separate releases of the All in One SEO plugin.
CVE-2026-85492
Version 5.0.2 addresses the cross-site scripting vulnerability. The plugin’s changelog describes the security improvements:
“Fixed: Improved security and access protections in SEO Revisions, SEO Analysis and the SEO Preview.”
CVE-2026-100152
Version 5.0.2.1 fixes the arbitrary shortcode execution vulnerability.
The changelog describes the update:
“Fixed: Improved security protections for shortcodes on search pages.”
Users of the All in One SEO WordPress plugin are recommended to update to version 5.0.2.1 or a newer patched version to protect against both vulnerabilities.
Featured Image by Shutterstock/Andrei Korzhyts
