All in One SEO Fixes Two Vulnerabilities That Require No Authentication

On October 13, 2026, Search Engine Journal reported two medium-severity vulnerabilities in the All in One SEO (AIOSEO) plugin for WordPress. Both can be exploited without an account, though under different conditions: one allows arbitrary shortcode execution, while the other allows a script to be injected through a specially crafted URL. Both issues have been fixed in version 5.0.2.1.

AIOSEO is installed on more than two million websites. The plugin helps manage SEO settings, XML sitemaps, structured data, redirects, and internal links. That makes the installed version important not just to SEO specialists: it also affects site security.

Shortcode execution depends on breadcrumbs

CVE-2026-100152 has a severity score of 6.5 and affects AIOSEO versions up to and including 5.0.2. The plugin did not properly validate the value passed to the WordPress do_shortcode function. As a result, an unauthenticated attacker could cause an arbitrary shortcode to execute.

A shortcode is an instruction that tells WordPress to display content or run a particular function. The mechanism itself is not a vulnerability. The problem was that AIOSEO allowed an instruction to execute without the necessary validation of its value. That distinction matters: this concerns a specific way of handling shortcodes, not every shortcode on the site.

There is one prerequisite for the attack: AIOSEO breadcrumbs—the navigation links that show where a page sits within a site—must be displayed on the WordPress search results page. They can be added through a block, widget, shortcode, or template. If breadcrumbs are not displayed there, the attack described here will not work. The lack of an authentication requirement remains significant for sites that meet this condition.

The fix was included in version 5.0.2.1. According to the update notes, the developers strengthened shortcode protection on search pages.

XSS requires a user with SEO management permissions

The second vulnerability, CVE-2026-85492, has a severity score of 6.1. It is a DOM-based XSS vulnerability: a malicious script can run in a user's browser. It affects AIOSEO versions up to and including 5.0.1.1; the fix was released in 5.0.2.

The cause lies in how the URL path was handled: input was not sufficiently sanitized, and output was not sufficiently escaped. An attacker without an account could craft a URL containing malicious code. But in the scenario described, simply visiting that URL is not enough to execute the script.

A WordPress user must have the aioseo_manage_seo permission and, while on a page with the malicious path in its URL, open the SEO Preview panel from the WordPress admin bar. In other words, the attack depends on an action by someone who can manage SEO features. This is not a scenario in which the script runs in the browser of any visitor who merely opens the link.

What to check on your site

Site owners or developers should check the installed AIOSEO version and update the plugin to 5.0.2.1 or a later patched version. Version 5.0.2 fixes the XSS vulnerability but does not yet address shortcode execution. It is easy to miss that the two fixes arrived in separate releases if you only look at the announcement for the first update.

After updating, it is worth checking whether AIOSEO breadcrumbs appear on the search results page. This helps determine whether the first attack scenario applies to a particular site, but it does not replace the update. For the second scenario, what matters is who has the aioseo_manage_seo permission: a crafted URL alone is not enough to carry out the attack.

Marketers who use SEO Preview do not need to understand the implementation of do_shortcode or DOM-based XSS. If someone else handles updates, they only need to pass along a request to check the plugin, along with both CVE numbers. A similar question of who is responsible comes up with WordPress's own security updates.

My take: attack conditions are no reason to delay the update

In my view, it is easy to mistake these conditions for a reason to do nothing. Yes, one attack requires breadcrumbs on the search page, while the other requires an action by a user with SEO permissions. But I would not rely on the right set of circumstances never arising.

I would also clarify who is responsible for plugin updates on each site. It is not a new feature or another screen, but it removes some manual guesswork: everyone knows who checks the installed version and when the task is complete.

Sources

Where the news comes from. The text is a retelling in the author’s own words; the facts come from the source, the opinion is the author’s.

1. All In One SEO WordPress Plugin Vulnerable To Two Exploits via @sejournal, @martinibuster www.searchenginejournal.com

About the author

Giorgi M.

Experienced e-commerce developer

I build online stores and integrate them with accounting systems. I like projects that eliminate an owner's manual work, rather than just add another screen.

All posts by the author