All in One SEO Plugin: Two Security Flaws, Update Now

All in One SEO, a WordPress SEO plugin with more than 2 million active installations, has two patched security flaws, with advisories published on October 1 and 2, 2026. One lets visitors run shortcodes without logging in on version 5.0.2 and earlier. The other is a cross-site scripting bug up to 5.0.1.1. The minimum safe version is 5.0.2.1.

What we know

  • The no-login flaw: according to Wordfence's advisory of October 2 (CVE-2026-100152), an unauthenticated visitor can make the site run any shortcode registered on it. It affects versions up to and including 5.0.2. Wordfence scores it 6.5 out of 10, medium severity.
  • Its precondition: the same advisory says it only applies when the All in One SEO breadcrumb trail is shown on the site's search results page, whether through the block, the widget, the shortcode or the template tag.
  • A second advisory of the same kind: WPScan published CVE-2026-19856 on October 2, credited to Jakub Herman, for versions before 5.0.2.1. WPScan says that on sites upgraded from older versions of the plugin the protection was disabled outright.
  • The XSS: Wordfence's advisory of October 1 (CVE-2026-85492) describes a cross-site scripting flaw up to 5.0.1.1, scored 6.1. It only works if someone allowed to manage SEO in All in One SEO opens its "SEO Preview" panel while visiting a crafted link.
  • The fixes: Wordfence lists 5.0.2 as patched for the XSS and 5.0.2.1 for the shortcode issue. The plugin's changelog for 5.0.2.1 notes improved security protections for shortcodes on search pages. The current version on wordpress.org is 5.0.3.
  • Who reported it: Search Engine Journal covered it on October 12. None of the sources reviewed mention attacks in the wild.

What changes and what doesn't

Both bugs are in the plugin, not in WordPress core. If your site does not run All in One SEO, they do not affect you.

If it does, the severity is medium, not critical. The real risk of the shortcode bug depends on your other plugins: an attacker can only trigger shortcodes that already exist on your site, such as forms or content blocks. It also depends on whether you show the All in One SEO breadcrumb on internal search results.

The XSS does not fire on its own. It needs an administrator or SEO editor to open a booby-trapped link with the preview panel open, which is one more reason to be wary of odd links to your own site arriving by email or chat.

The fix is the same for both: run 5.0.2.1 or later.

How to tell if it affects you

  1. Check the version. In the WordPress dashboard, go to Plugins and find All in One SEO. If it shows 5.0.2 or earlier, you are in the affected range.
  2. Update. Move to the latest release (5.0.3 at the time of writing) or at least 5.0.2.1. Take a backup first if your site does not make them automatically.
  3. Turn on automatic updates for this plugin on the same screen if nobody reviews your site's updates every week.
  4. Check whether you were exposed to the no-login flaw. Run a search with your site's own search box. If the results page shows the All in One SEO breadcrumb trail (something like "Home › Search results"), your site met the precondition while it ran an older version.
  5. If someone else or a managed host runs your site, ask them: "Which version of All in One SEO does my site run, and when was it updated to 5.0.2.1 or later?"

Related: Bricksforge Flaw Under Attack on WordPress: Update Now

Sources

Updates: this article will note it if a primary source reports attacks using these flaws.