All in One SEO WordPress Plugin Vulnerable to Two Exploits

Security updates are often the most boring part of managing a website until you realize that a plugin you trust has a hole in it. When a tool is used by millions of sites, it becomes a high value target for attackers because one single vulnerability can open thousands of doors at once. A useful companion note is X Robots Tag, because it looks at a nearby part of the same system.

Recently, two security flaws were identified in the All in One SEO (AIOSEO) plugin. Both are classified as medium severity, but they allow unauthenticated users to potentially compromise a site under specific conditions. If you use this plugin, it is worth understanding exactly what happened and why the update is non negotiable.

The Role of All In One SEO in WordPress

AIOSEO is one of the most widely adopted SEO tools for WordPress, currently powering over two million installations. For most of us, it acts as the central hub for managing how a site appears in search results. It handles the technical heavy lifting like XML sitemaps, structured data, and redirects, while also providing tools for internal linking and content optimization. This connects with BigCommerce to Scale WordPress Stores when the same signal needs a clearer operating decision. The same pattern also shows up in to Use HTML Sitemaps, where the practical question is how the signal becomes visible.

Beyond the basics, the plugin has evolved to include AI content generation, SEO auditing, and rank monitoring. Because it touches so many parts of the site architecture and interacts with the WordPress admin toolbar, any vulnerability within its code can have a broad impact on the overall security posture of the website.

From a management perspective, the tradeoff here is convenience versus surface area. The more features a plugin adds, the more code there is to maintain and the more potential entry points there are for an exploit. This is why auditing your plugin list and keeping them updated is a critical part of site maintenance.

CVE 2026 to 100152: Unauthenticated Arbitrary Shortcode Execution

The first vulnerability, tracked as CVE 2026 to 100152, carries a severity rating of 6.5. This flaw affects all versions of the plugin up to and including 5.0.2. The core of the issue is that an attacker does not need an account or any special privileges to exploit it.

The technical cause is a missing validation check. In WordPress, shortcodes are essentially shortcuts that tell the system to execute a specific function or display a piece of content. The plugin uses a function called do_shortcode to process these. Because the plugin failed to properly validate a value before running this function, an attacker can force the site to execute arbitrary shortcodes.

However, there is a specific condition required for this to work. The AIOSEO breadcrumbs must be rendered on the search results page via a widget, block, shortcode, or template tag. Breadcrumbs are those small navigation paths that show a user where they are in the site hierarchy. If these are active on your search pages, the vulnerability is active.

This is a significant risk because it bypasses the need for authentication. Usually, we assume that if a user isn't logged in, they can't trigger backend functions. This exploit proves that assumption wrong. When deciding how to prioritize this, look at your search page layout. If you use AIOSEO breadcrumbs there, this is a high priority fix.

CVE 2026 to 85492: Unauthenticated XSS Vulnerability

The second flaw, CVE 2026 to 85492, is a DOM based Cross Site Scripting (XSS) vulnerability with a severity rating of 6.1. This affects versions up to and including 5.0.1.1. While this also involves unauthenticated attackers, the path to exploitation is more complex than the shortcode issue.

The problem stems from insufficient input sanitization and output escaping when the plugin handles a URL pathname. In simple terms, the plugin wasn't properly cleaning the data coming from a URL before displaying it, which allows an attacker to embed a malicious script into a specially crafted link.

For this to actually work, a specific set of events must occur. First, a user with the aioseo_manage_seo capability (typically an administrator or SEO manager) must visit the malicious URL. Second, that user must open the SEO Preview panel from the WordPress admin toolbar while on that page. If the user just visits the link but doesn't open the preview panel, the script doesn't execute.

The tradeoff here is that while the "barrier to entry" is higher for the attacker, the target is a high privilege user. XSS attacks targeting admins are dangerous because they can lead to session hijacking or unauthorized administrative changes. You should inspect who has the aioseo_manage_seo permission on your site and ensure they are trained not to click suspicious links while logged in.

Resolving the Vulnerabilities

The developers of All In One SEO have released patches for both of these issues. Because they were addressed in different versions, it is important to ensure you have the most recent one to cover all bases.

Fixing the XSS Flaw (CVE 2026 to 85492)

The cross site scripting vulnerability was addressed in version 5.0.2. The update focused on improving security and access protections specifically within the SEO Preview, SEO Analysis, and SEO Revisions sections of the plugin. By tightening how the plugin handles data in these areas, the path for script injection was closed.

Fixing the Shortcode Execution (CVE 2026 to 100152)

The more critical arbitrary shortcode execution flaw was fixed in version 5.0.2.1. The changelog for this version explicitly mentions improved security protections for shortcodes on search pages. This update adds the necessary validation checks that were previously missing, preventing unauthenticated users from triggering the do_shortcode function maliciously.

To be fully protected against both exploits, you need to be running version 5.0.2.1 or later. If you are on any version prior to this, your site is potentially exposed. The most direct path forward is to update the plugin immediately through the WordPress dashboard. If you use a staging environment, test the update there first to ensure no conflicts with your theme, but given the nature of these vulnerabilities, the window for testing should be kept very short.

All In One SEO WordPress Plugin

The All in One SEO (AIOSEO) WordPress plugin is a popular SEO plugin used by over 2 million users. It's used to manage search engine optimization settings on WordPress websites. It also provides tools for managing XML sitemaps, structured. Local visibility depends on whether the details across pages, profiles, categories, reviews, photos, and service descriptions reinforce the same answer for a specific location based query.

The operational question is whether the public business data is complete enough to support the query. Hours, categories, services, reviews, photos, and page content need to reinforce each other so Google can understand the business in a specific situation, not only as a generic listing.

CVE 2026 to 100152 Unauthenticated Arbitrary Shortcode Execution Vulnerability

The first vulnerability, rated 6.5 (Medium), affects all versions of AIOSEO up to and including 5.0.2. It enables unauthenticated attackers to execute arbitrary WordPress shortcodes when specific conditions are met. What makes this. The search implication is whether the section improves the evidence around the page, not simply whether it adds more wording. Clear entities, crawlable structure, internal links, and useful context are what make the topic easier to evaluate.

The risk is usually hidden in the execution layer. A page can look fine to a human and still fail for an automated visitor if the form, call to action, rendering path, or confirmation step is not accessible enough for the agent to complete the task.