Unknown All In One SEO vulnerabilities
4 vulnerabilities
Known vulnerabilities in Unknown All In One SEO, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2024-3368aioseo · all_in_one_seo +2 moreAll in One SEO < 4.6.1.1 - Contributor+ Stored XSSThe All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacksEPSS0.37%MediumCVE-2026-19856unknown · all in one seo +1 moreAll in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search QueryThe All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.EPSS0.18%MediumCVE-2026-10755unknown · all in one seo +1 moreAll in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI IntegrationThe All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.EPSS0.28%MediumCVE-2026-82884unknown · all in one seo +1 moreAll in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant BlockThe All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privileged user edits the post.EPSS0.43%