Two unauthenticated security vulnerabilities in the All in One SEO WordPress plugin put more than 2 million active installations at risk, and both are now patched in plugin versions 5.0.2 and 5.0.2.1. Wordfence disclosed both flaws. Neither exploit requires the attacker to hold an account on the target site.

The first vulnerability, tracked as CVE-2026-100152, carries a 6.5 Medium severity rating. It affects every version of AIOSEO up to and including 5.0.2. The flaw lets unauthenticated attackers execute arbitrary WordPress shortcodes when specific conditions are met. Version 5.0.2.1 fixes it.

The second, CVE-2026-85492, carries a 6.1 Medium rating and affects all versions up to and including 5.0.1.1. It is a DOM-based cross-site scripting vulnerability. Version 5.0.2 fixes it.

What does CVE-2026-100152 actually allow?

The shortcode flaw stems from a missing validation check before the plugin calls the WordPress do_shortcode function. Shortcodes are instructions that tell WordPress to perform functions, such as displaying content or running a feature. The do_shortcode function processes those instructions.

The plugin fails to properly check a value before executing a shortcode. That gap lets an attacker force the site to run arbitrary shortcodes without any user privileges.

Wordfence describes the critical precondition:

"This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag."

That limitation matters. Breadcrumbs are the navigation links showing visitors where a page sits within a site's structure. The exploit only works when AIOSEO breadcrumbs appear on the WordPress search results page through one of the four methods Wordfence identified. Sites that do not render breadcrumbs on search results pages are not exposed to this specific attack path.

Attackers need no account and no privileges. The exposure instead depends entirely on how each site configures the plugin's breadcrumb feature.

How does the XSS vulnerability work?

CVE-2026-85492 involves insufficient input sanitization and output escaping in the handling of a URL pathname. Input sanitization and output escaping are security measures that stop untrusted information from executing as code. Their absence lets attackers plant malicious scripts inside a specially constructed URL.

Wordfence explains the attack chain:

"This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname."

The conditions make this flaw harder to exploit than the shortcode bug. Visiting the malicious URL alone is not enough. The victim must hold the aioseo_manage_seo capability, a WordPress permission tied to managing SEO features. That user must also open the plugin's SEO Preview panel from the admin toolbar while visiting the crafted URL.

DOM-based XSS executes in the victim's browser. The attack therefore depends on the actions of a user with the required SEO permission, not on direct access to the site by the attacker.

For an SEO team, the practical risk profile differs sharply between the two bugs:

• Shortcode execution (6.5): no login required, but only exploitable when AIOSEO breadcrumbs render on WordPress search results pages via block, widget, shortcode or template tag.
• XSS (6.1): no attacker login required, but a user with aioseo_manage_seo must open the SEO Preview panel while on a malicious URL.

What did the patches change?

Both fixes shipped in separate plugin releases, according to the AIOSEO changelog.

Version 5.0.2, which addresses the cross-site scripting vulnerability, states: "Fixed: Improved security and access protections in SEO Revisions, SEO Analysis and the SEO Preview."

Version 5.0.2.1, which fixes the arbitrary shortcode execution flaw, states: "Fixed: Improved security protections for shortcodes on search pages."

The changelog language confirms which release closes which hole. A site running 5.0.2 is protected against the XSS flaw but remains open to shortcode execution. Only 5.0.2.1 or newer closes both.

What should site operators do now?

Every site running All in One SEO should update to version 5.0.2.1 or later. The plugin handles XML sitemaps, structured data, redirects, internal links, content optimization, rank monitoring, SEO audits and AI content generation for over 2 million users, so the patch surface spans common publishing and e-commerce stacks alike.

Site operators who cannot update immediately should audit whether AIOSEO breadcrumbs render on WordPress search results pages. Removing them from that page blocks the known precondition for CVE-2026-100152. Restricting the aioseo_manage_seo capability to a small set of trusted administrators reduces the pool of viable XSS targets.

Monitor the AIOSEO changelog and Wordfence advisories for any follow-up disclosures tied to these CVEs, since exploit code for disclosed WordPress plugin flaws frequently appears in automated attack campaigns within days of publication.