Home / News / All in One SEO WordPress Plugin Vulnerable to Two Exploits
All in One SEO WordPress Plugin Vulnerable to Two Exploits
The All in One SEO plugin, powering over two million WordPress sites, now contains two critical flaws that let unauthenticated users execute arbitrary shortcodes or inject malicious scripts. Both vulnerabilities—CVE‑2026‑100152 and CVE‑2026‑100153—were patched in version 5.0.3 released on 12 Oct 2026. Business owners should verify their plugin version, upgrade immediately, and audit their sites for any injected code.
Key Highlights
- ✓Two CVEs discovered in All in One SEO plugin
- ✓Unauthenticated attackers can run arbitrary shortcodes
- ✓Immediate update to version 5.0.3 is required
- ✓AI citations may be affected if site is compromised
What Happened
In early October 2026, Search Engine Journal reported that the All in One SEO (AIOSEO) WordPress plugin—used by more than two million sites—harbors two serious vulnerabilities that allow attackers to execute arbitrary shortcodes or inject malicious scripts without requiring authentication.
The first flaw (CVE‑2026‑100152) affects every AIOSEO release up to 5.0.2. A missing validation step lets an unauthenticated user trigger WordPress’s do_shortcode function, enabling the execution of any shortcode installed on the site. The second issue (CVE‑2026‑100153) is a cross‑site scripting (XSS) bug that surfaces when certain shortcode attributes are not properly sanitized.
Both problems carry a medium severity rating (CVSS 6.5), but they can be leveraged to compromise site integrity, deface pages, or deliver malware.
Key Details
- Affected Versions: AIOSEO 5.0.2 and earlier.
- What It Does: Grants attackers the ability to run any shortcode or inject JavaScript.
- Why It Matters: No login is required—anyone can hit the vulnerable endpoint.
- Impact on SEO: Compromised content can trigger search‑engine penalties, and malicious code may be flagged by AI assistants as spam.
- Patch Status: The plugin developer released version 5.0.3 on 12 Oct 2026, fixing both CVEs.
How to Check
1. Log into your WordPress dashboard.
2. Navigate to Plugins → Installed Plugins.
3. Look for All in One SEO and verify the version.
4. If you’re on 5.0.2 or older, update immediately.
What It Means For Your Business
- Protect Your Local Visibility: A compromised site can erode customer trust and upset AI tools that rely on clean, reliable content.
- Avoid AI‑Driven Penalties: ChatGPT, Gemini, and other AI search engines flag sites with injected scripts as untrustworthy, reducing citation chances.
- Maintain Citation Momentum: Your local citations and backlinks are part of the trust chain; a breach could invalidate those signals.
- Compliance & Reputation: Data breaches expose you to legal risks and damage brand reputation.
Businesses that depend on the AIOSEO plugin for structured data, XML sitemaps, and on‑page optimization should treat this as a top‑priority fix.
Next Steps
1. Update: Install AIOSEO 5.0.3 or later.
2. Audit: Scan your site for injected code or unexpected shortcode output.
3. Backup: Restore a clean backup if you detect anomalies.
4. Monitor: Use a security plugin or a web‑application firewall to block suspicious requests.
5. Educate: Keep your team aware that no plugin is immune to security flaws.
By acting swiftly, you protect your site’s integrity, preserve your AI‑citation profile, and keep your local customers trusting your brand.
Why This Matters For Your Business
When AI assistants such as ChatGPT, Gemini, or Perplexity crawl your site, they assess not only the relevance and structure of your content but also its security posture. A site that has been compromised with injected scripts is flagged as unreliable, causing these models to lower its ranking in AI‑generated answers or exclude it entirely. For local businesses, this means missing out on quick‑answer slots and featured snippets that drive foot traffic and phone calls. Additionally, a security breach can expose sensitive customer data, lead to downtime, and tarnish your brand’s reputation—factors that directly affect customer acquisition and retention.
Frequently Asked Questions
How do I know if my site is vulnerable?
Open your WordPress dashboard, go to *Plugins* → *Installed Plugins*, and verify the AIOSEO version. If you’re running 5.0.2 or an earlier release, your site is vulnerable.
Will updating fix all problems?
Updating to AIOSEO 5.0.3 or a newer release resolves both CVEs. Once the update is applied, perform an audit to ensure no residual malicious code remains.
Can I disable shortcodes to mitigate the risk?
Disabling shortcodes could break essential site features, so it’s not recommended. The best mitigation is to upgrade the plugin and add a web‑application firewall to block suspicious requests.
Is your business showing up in AI search?
Get your free AI visibility audit - see if ChatGPT, Perplexity, and Google AI actually recommend you.