All in One SEO CVE-2026-82884

The attacker must hold at minimum a contributor role on the target WordPress site - subscriber accounts are insufficient. The exploit is stored, meaning no real-time attacker presence is needed after initial payload injection, but the attack only fires when a higher-privileged user (editor, administrator, or super admin) opens the affected post in the wp-admin post editor interface; the payload does not execute on the public-facing frontend. The vulnerability is specific to content stored through All in One SEO plugin fields, not core WordPress post content. Sites where contributor accounts are granted only to vetted, trusted users have significantly reduced practical exposure, as the required access level is the primary limiting factor.

The provided CVSS 6.8 vector (PR:H) understates real-world risk: contributor is a low-privilege role in WordPress, making PR:L more accurate for the minimum required access level. The UI:R component reflects that a higher-privileged user must edit the poisoned post, introducing an exploitation dependency - but this dependency is routinely satisfied in any active site. The stored nature of the payload means no ongoing interaction with the attacker is required after initial injection. A publicly available PoC from WPScan materially lowers the bar for exploitation, and even a mid-sized municipal IT team in gdynia running an outdated All in One SEO installation on their public-facing WordPress site should treat this as urgent given the plugin's ubiquity. EPSS data is not provided, limiting probabilistic exploitation estimates. No KEV listing is present in the input data, so widespread in-the-wild exploitation is not confirmed, though the POC and high plugin prevalence suggest opportunistic exploitation is plausible.

An attacker who has registered or compromised a contributor account on a WordPress site injects a malicious JavaScript payload into an All in One SEO field within a post - for example, an SEO title or description field - and saves the draft. When a site administrator or editor opens that post in the WordPress post editor to review or publish it, the stored script executes silently in the admin's browser, capable of exfiltrating the admin's authentication cookies or issuing privileged WordPress REST API calls to create a rogue admin account. A publicly available PoC from WPScan demonstrates this exploitation path.