By Priya Raman

Two security vulnerabilities in the All in One SEO (AIOSEO) WordPress plugin put more than two million active installations at risk, and both allowed unauthenticated attackers to run malicious code under specific conditions. The plugin's developers have patched both flaws, but only sites running version 5.0.2.1 or newer are protected.

The disclosure, reported by Wordfence, affects one of the most widely used SEO plugins in the WordPress ecosystem. AIOSEO manages search engine optimization settings, XML sitemaps, structured data, redirects, internal links, content optimization, rank monitoring, SEO audits and AI content generation.

What does the shortcode flaw allow?

The first vulnerability, tracked as CVE-2026-100152 and rated 6.5 (Medium), affects all versions of AIOSEO up to and including 5.0.2. It lets attackers without an account or any user privileges execute arbitrary WordPress shortcodes when specific conditions are met.

The cause is a missing validation check before the plugin runs the WordPress do_shortcode function, which processes instructions that tell WordPress to perform functions such as displaying content.

Wordfence stated: "This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag."

That limitation matters. The flaw depends on how a site uses the plugin's breadcrumb feature: the navigation links showing where a page sits within a site. Sites that do not render AIOSEO breadcrumbs on WordPress search results pages close off this attack path.

What does the XSS flaw require?

The second vulnerability, tracked as CVE-2026-85492 and rated 6.1 (Medium), is a DOM-based cross-site scripting (XSS) flaw affecting all versions up to and including 5.0.1.1. Insufficient input sanitization and output escaping in the handling of a URL pathname lets attackers embed malicious scripts in a crafted URL.

Wordfence explained: "This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname."

Visiting the malicious URL alone is not enough. The victim must hold the aioseo_manage_seo WordPress capability and must open the plugin's SEO Preview panel from the admin toolbar while on the crafted URL. Because the script is DOM-based, it executes in the victim's browser rather than on the server.

What should marketers and site owners do now?

Both vulnerabilities are patched in separate releases:

• Version 5.0.2 fixes the XSS flaw. The changelog reads: "Fixed: Improved security and access protections in SEO Revisions, SEO Analysis and the SEO Preview."
• Version 5.0.2.1 fixes the arbitrary shortcode execution flaw. The changelog reads: "Fixed: Improved security protections for shortcodes on search pages."

For teams that manage SEO at scale, the practical step is a version audit this week: confirm every AIOSEO installation runs 5.0.2.1 or newer, and check whether breadcrumbs render on search results pages. Wordfence recommends updating to 5.0.2.1 or a later patched version to close both attack paths.