AI NewsGo-to-marketAnnouncement
AIOSEO WordPress plugin ships two vulnerabilities, update to 5.0.2.1 now
Wordfence disclosed two medium-severity flaws in the All in One SEO WordPress plugin, which runs on more than two million sites, both fixed in version 5.0.2.1.
Image: Search Engine Journal
Why it mattersA plugin team or site owner running the free version has to update AIOSEO today, because one of the two bugs lets an attacker who never signed in run WordPress shortcodes on the page.
A plugin on more than two million WordPress sites can be made to run attacker-chosen WordPress shortcodes without anyone signing in. The All in One SEO team has shipped a fix, and anyone running the free or paid version has to update to version 5.0.2.1 today.
Wordfence disclosed two separate flaws in the plugin and Search Engine Journal reported them in a piece by Roger Montti. One is an arbitrary shortcode execution bug in every version up to and including 5.0.2, tracked as CVE-2026-100152 and rated 6.5 (medium). The other is a DOM-based cross-site scripting bug in every version up to and including 5.0.1.1, tracked as CVE-2026-85492 and rated 6.1 (medium).
The shortcode bug, and when it fires
The shortcode flaw is the one site owners should look at first. Wordfence writes that the plugin "does not properly validate a value before running do_shortcode," which lets an unauthenticated attacker execute arbitrary shortcodes. An attacker needs no user account on the site.
There is a condition. The bug only fires when an AIOSEO breadcrumb renders on a WordPress search results page, through the block, widget, shortcode or template tag. A site that uses AIOSEO breadcrumbs anywhere on the site is at risk, because many themes put breadcrumbs on the search results page. A site that has turned the breadcrumb feature off is not.
The cross-site scripting bug, and who it targets
The second flaw is a DOM-based cross-site scripting bug in how the plugin handles a URL pathname. An attacker crafts a URL and sends it to a WordPress user who holds the aioseo_manage_seo capability. If that user clicks the link and opens the SEO Preview panel in the admin toolbar while on the attacker's page, the script runs in the browser of that signed-in user. Wordfence says the specific sequence is what makes the flaw harder to exploit than the first one.
The targeted account is one with full SEO rights, which usually means an administrator or an editor. A compromised session there can post, publish or change pages, so the limited reach is still a serious outcome if the exploit chain completes.
The fixes, and the two versions
The plugin's own changelog describes the fixes in two short lines. Version 5.0.2 adds the fix for the cross-site scripting bug: "Improved security and access protections in SEO Revisions, SEO Analysis and the SEO Preview." Version 5.0.2.1 adds the fix for the shortcode bug: "Improved security protections for shortcodes on search pages." Both patches must be present to close both flaws, so sites still on 5.0.2 are only half patched.
A site using the WordPress automatic update feature for plugins may already have 5.0.2.1 installed. A site that reviews plugin updates by hand needs to look at the AIOSEO row in the plugin list today, because the shortcode bug is reachable without an account and the two million install count means attackers have a reason to look for sites that have not updated.
Source
All In One SEO WordPress Plugin Vulnerable To Two Exploits, Roger Montti, Search Engine Journal, citing Wordfence.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
