A security advisory has flagged two vulnerabilities in All in One SEO, a WordPress plugin with over two million active installations. Both let unauthenticated attackers execute arbitrary shortcodes or inject malicious scripts under specific conditions, according to Search Engine Journal’s report on the advisory.
All in One SEO, also called AIOSEO, manages SEO settings, XML sitemaps, structured data, redirects and internal links. It also offers rank monitoring, site audits and AI content tools.
The All In One SEO Shortcode Vulnerability
The first flaw, CVE-2026-100152, is rated 6.5, or Medium. It affects all versions up to and including 5.0.2 and lets unauthenticated attackers execute arbitrary WordPress shortcodes.
The cause is a missing validation check before the plugin runs the WordPress do_shortcode function. Shortcodes are instructions that tell WordPress to display content or run a feature.
Wordfence said exploitation “requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag.” So although attackers do not need to log in, the risk depends on how a site uses the breadcrumb feature.
The Cross-Site Scripting Flaw
The second flaw, CVE-2026-85492, is rated 6.1, or Medium. It is a DOM-based cross-site scripting vulnerability affecting versions up to and including 5.0.1.1.
It comes from insufficient input sanitization and output escaping in how the plugin handles a URL pathname. Those missing protections let attackers place malicious scripts in a specially built URL.
The WordPress Developer handbook describes sanitizing input as “the process of securing/cleaning/filtering input data.” It describes escaping output as “the process of securing output data by stripping out unwanted data, like malformed HTML or script tags.”
The aioseo_manage_seo capability is a WordPress permission tied to managing the plugin’s SEO features, so the flaw depends on the actions of a user who holds it.
Wordfence said exploitation “requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar.” Visiting the malicious URL alone is not enough, and the script runs in that user’s browser.
Update All In One SEO Now
Both flaws are patched in separate releases. Version 5.0.2 fixes the cross-site scripting flaw, with a changelog note on “Improved security and access protections in SEO Revisions, SEO Analysis and the SEO Preview.”
Version 5.0.2.1 fixes the shortcode flaw, described as “Improved security protections for shortcodes on search pages.” Users are advised to update All in One SEO to version 5.0.2.1 or a newer patched version.
Related reading: the UpdraftPlus breach that planted backdoors, the Jetpack 16.3 update and WordPress 7.2 Beta 1.
