All In One Seo Ai Seo Plugin To Boost Seo Rankings Traffic Schema Local Seo Sitemap Seo Insights
Monthly
Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.
DOM-based cross-site scripting (XSS) in the All in One SEO WordPress plugin, versions up to and including 5.0.1.1, allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL pathname, but successful exploitation requires a victim who holds the aioseo_manage_seo capability to open the SEO Preview panel in the WordPress admin toolbar while visiting the malicious URL. No public exploit code or active exploitation in the wild has been identified at time of analysis, and the substantial victim interaction and privilege requirements make this a moderate-risk, defense-in-depth issue rather than an urgent threat.
Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.
DOM-based cross-site scripting (XSS) in the All in One SEO WordPress plugin, versions up to and including 5.0.1.1, allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL pathname, but successful exploitation requires a victim who holds the aioseo_manage_seo capability to open the SEO Preview panel in the WordPress admin toolbar while visiting the malicious URL. No public exploit code or active exploitation in the wild has been identified at time of analysis, and the substantial victim interaction and privilege requirements make this a moderate-risk, defense-in-depth issue rather than an urgent threat.