If you run a WordPress site with All in One SEO, check your plugin version now. Two security holes have just been disclosed in the plugin used by more than 2 million sites, and both can be reached by attackers who never log in.
The two AIOSEO vulnerabilities
The first flaw, CVE-2026-100152, is an unauthenticated arbitrary shortcode execution issue rated 6.5 out of 10. It affects all versions up to and including 5.0.2. The weakness is a missing validation check before the plugin runs WordPress’s do_shortcode function.
Shortcodes are small instructions WordPress uses to run functions, such as rendering a form or pulling in content. Wordfence says the bug “makes it possible for unauthenticated attackers to execute arbitrary shortcodes.” The catch: AIOSEO breadcrumbs must be rendered on a search results page via a block, widget, shortcode or template tag.
The second flaw, CVE-2026-85492, is a DOM-based cross-site scripting issue rated 6.1. It affects versions up to and including 5.0.1.1. Exploitation requires an authorized user with the aioseo_manage_seo capability to open the plugin’s SEO Preview panel while visiting a URL containing a malicious payload.
Both are medium severity, but the headline detail is the unauthenticated part: for the first flaw, no account, no role and no login is required.
Why site owners should move fast
For marketing teams, these bugs sit where SEO and site security overlap. A compromised marketing site can silently serve malicious shortcodes or run scripts inside an admin’s browser. That can lead to redirects, data theft or SEO spam injected into your pages.
Neither flaw is a universal one-click takeover. One depends on how you display breadcrumbs on search pages; the other depends on a specific action by a user with SEO permissions. That is why these CVEs are medium rather than critical, but it also means your exposure depends on your exact setup.
- Shortcode execution: no login needed, but breadcrumbs must appear on search results.
- DOM XSS: no login needed for the attacker, but the victim must have SEO permissions and open the SEO Preview panel.
- Patch: version 5.0.2 fixes the XSS issue; version 5.0.2.1 fixes the shortcode flaw.
What to do today
Update All in One SEO to version 5.0.2.1 or newer. That single update covers both vulnerabilities. If you manage multiple client sites, check the plugin version across your portfolio and prioritize any site where SEO preview tools are used or AIOSEO breadcrumbs are live on search pages.
Also review which WordPress users hold the aioseo_manage_seo capability. If those accounts are shared, stale or over-provisioned, clean them up. A plugin update closes the door, but tighter permissions make it harder for the next bug to cause real damage.
Turn the patch into a client audit
If you manage SEO for clients, use this disclosure as a reason to run a quick plugin-health sweep. Start with the sites where All in One SEO is active, then confirm the version, auto-update status and the number of WordPress users holding SEO permissions. Sites matching the exploitation conditions should be patched first.
The CVE number is less important than the fit. A medium flaw that lines up with how a site is configured can be riskier than a critical flaw that requires conditions you do not meet.
Source: Search Engine Journal
