Two vulnerabilities have been reported in the All in One SEO (AIOSEO) WordPress plugin, which has more than two million active installations. The flaws could let unauthenticated attackers trigger shortcodes or inject scripts in specific circumstances. Both have been patched, and site owners should check their installed version as part of routine WordPress maintenance.
Key takeaways
A current WordPress care plan should include a reliable process for checking plugin updates and confirming that security fixes are applied. These AIOSEO issues have different conditions for exploitation, but users should install version 5.0.2.1 or later.
- The shortcode flaw affects AIOSEO versions up to and including 5.0.2.
- The cross-site scripting (XSS) flaw affects versions up to and including 5.0.1.1.
- The shortcode issue depends on AIOSEO breadcrumbs appearing on search results pages.
- Update to version 5.0.2.1 or a newer patched release to address both flaws.
What the vulnerabilities could allow
The first issue, CVE-2026-100152, is rated medium severity and involves the plugin processing WordPress shortcodes without adequately checking a value first. Shortcodes can trigger features or display content. An attacker does not need an account, but the flaw only applies when an AIOSEO breadcrumb is rendered on a search results page using a block, widget, shortcode or template tag.
The second issue, CVE-2026-85492, is a medium-severity DOM-based XSS flaw. A specially crafted URL could carry a script that runs in a user’s browser. Exploitation requires a user with the aioseo_manage_seo capability to visit the affected page and open the SEO Preview panel in the WordPress admin toolbar. Simply visiting the URL is not enough.
Which versions fix the flaws?
AIOSEO version 5.0.2 addressed the XSS vulnerability, while version 5.0.2.1 fixed the shortcode issue. The plugin’s update notes refer to improved protections for SEO features and shortcodes on search pages. Because the fixes arrived in separate releases, updating only to 5.0.2 does not resolve the shortcode vulnerability.
Check the AIOSEO version in your WordPress dashboard and update to 5.0.2.1 or later. If updates are managed for you through a WordPress maintenance plan, confirm that the patched version has been installed rather than assuming the plugin is current.
Make plugin updates part of site care
Plugin updates are an important part of reducing avoidable security risk, but site owners should also make sure updates are monitored and that their sites can be recovered if a change causes problems. A dependable WordPress care plan can help keep routine maintenance on the calendar; administrators should still verify that critical security releases are applied promptly.
- All In One SEO WordPress Plugin Vulnerable To Two Exploits, Search Engine Journal.