Two security vulnerabilities, including arbitrary shortcode execution and cross-site scripting, were discovered in the All in One SEO WordPress plugin, impacting more than 2 million active installations globally.
These flaws could allow attackers to compromise websites, requiring users to update their plugin software immediately, according to cybersecurity researchers.
The vulnerabilities, identified by security firm Wordfence, affect versions of the All in One SEO (AIOSEO) plugin up to and including 5.0.2.1, Wordfence reported.
One vulnerability, tracked as CVE-2026-100152, is an unauthenticated arbitrary shortcode execution flaw rated 6.5 Medium, impacting AIOSEO versions up to and including 5.0.2.
Exploitation of CVE-2026-100152 requires AIOSEO breadcrumbs to be rendered on a WordPress search results page via a block, widget, shortcode, or template tag.
The second vulnerability, CVE-2026-85492, is an unauthenticated DOM-based Cross-Site Scripting (XSS) vulnerability, rated 6.1 Medium, affecting AIOSEO versions up to and including 5.0.1.1.
To exploit CVE-2026-85492, an authorized WordPress user with ‘aioseo_manage_seo’ capability must visit a specially crafted URL and open the SEO Preview panel, Wordfence researchers said.
Both vulnerabilities have since been patched by the plugin developers; CVE-2026-85492 was addressed in version 5.0.2, and CVE-2026-100152 was fixed in version 5.0.2.1.
Users of the All in One SEO WordPress plugin are advised to update to version 5.0.2.1 or newer to protect their websites against both potential exploits, according to a report by Search Engine Journal.
Shutterstock, a company that utilizes WordPress, was among the organizations that could potentially be affected by such widespread plugin vulnerabilities.
Source: Search Engine Journal
