Two security flaws were disclosed in All in One SEO (AIOSEO), a plugin active on more than 2 million sites. Both are rated medium severity. Both are fixed.
What the flaws are
The first flaw (CVE-2026-100152, rated 6.5) affects versions up to 5.0.2. It lets someone without an account run arbitrary shortcodes. Shortcodes are small tags that tell WordPress to display content or run a feature.
Wordfence says this only works if the AIOSEO breadcrumb is shown on your search results page. Breadcrumbs are the trail of links that show where a page sits on your site. That can happen through a block, widget, shortcode, or template tag.
The second flaw (CVE-2026-85492, rated 6.1) affects versions up to 5.0.1.1. It is a cross-site scripting flaw, meaning a crafted web address can run an attacker’s script in a browser.
This one is harder to pull off. Wordfence says the victim must have the aioseo_manage_seo permission. They must also open the SEO Preview panel in the admin toolbar while on a page with a malicious address.
What to do
Update All in One SEO to version 5.0.2.1 or newer. Version 5.0.2 fixes the script flaw. Version 5.0.2.1 fixes the shortcode flaw.
The plugin’s changelog describes the fixes as improved security protections for shortcodes on search pages, and in SEO Revisions, SEO Analysis, and the SEO Preview.
The current release is 5.0.3, so updating to the latest version covers both fixes. If you cannot update right away, check whether your theme shows AIOSEO breadcrumbs on search results pages.
End of article