All in One SEO EUVD-2026-91336

Exploitation requires a confluence of conditions that significantly limit it: (1) the target site runs All in One SEO ≤5.0.1.1; (2) the VICTIM must be a logged-in WordPress user holding the aioseo_manage_seo capability (typically administrators/SEO managers); (3) that victim must actively open the SEO Preview panel in the WordPress admin toolbar; and (4) the victim must be viewing a page whose URL pathname contains the attacker's payload. The attacker themselves needs no authentication (PR:N) but cannot trigger execution without this privileged-victim interaction (UI:R). Limiting factors: attack fails against non-privileged users, fails if the SEO Preview panel is never opened, and depends on successful social engineering to deliver the crafted URL. This is not exploitable against default configurations without targeted user interaction by a high-capability account.

This is a moderate-risk, defense-in-depth issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) describes a DOM-based reflected XSS: network-reachable and requiring no attacker authentication, but gated by required user interaction (UI:R) and limited to low confidentiality/integrity impact with scope change. Crucially, the description adds conditions NOT fully captured by the raw vector: the VICTIM must hold the aioseo_manage_seo capability AND actively open the SEO Preview panel in the admin toolbar while on an attacker-crafted URL. This materially narrows realistic exploitation to a social-engineering attack against a specific class of privileged WordPress users. No EPSS score, KEV listing, or POC indicator is present in the input - exploitation status is therefore 'no public exploit identified at time of analysis'. There is no SSVC decision data provided. Signals are internally consistent (PR:N attacker, UI:R victim interaction), so there is no network-vs-local conflict to flag; however, the heavy reliance on privileged-victim interaction means the real-world risk is lower than the 6.1 score alone might suggest for a plugin with a very large install base. Treat as a routine-but-not-urgent patch.

An attacker crafts a URL for a WordPress site running the vulnerable plugin, embedding a malicious script payload in the URL pathname, and lures a logged-in user with the aioseo_manage_seo capability to visit it. When that privileged user opens the SEO Preview (Google Search Preview) panel from the admin toolbar on that page, the unsanitized pathname is written to a DOM sink and the script executes in their authenticated admin-area session. No public exploit code was identified at time of analysis, though the vulnerable client-side JavaScript (GoogleSearchPreview.js) is referenced publicly.