All in One SEO plugin patched for two vulnerabilities

Search Engine Journal’s Roger Montti reported on 12 October 2026 that two security vulnerabilities were disclosed in the All in One SEO (AIOSEO) WordPress plugin, which he puts at more than 2 million active installations. We fetched the CVE records for both from the CIRCL CVE API. Wordfence is the assigning authority on each, and the figures below come from those records and the plugin’s changelog on WordPress.org. Wordfence’s own advisory pages returned a bot check when we requested them, so we did not read those pages.

What is CVE-2026-100152?#

It is an unauthenticated arbitrary shortcode execution flaw. The Wordfence record says all versions up to and including 5.0.2 are affected, and it scores the flaw 6.5, which is medium. The cause, in the record’s words, is that the plugin does not properly validate a value before running do_shortcode.

The record adds a condition: the plugin’s breadcrumb has to be rendered on the search results page, through the block, widget, shortcode or template tag. Montti notes this means the exposure depends on how a site uses breadcrumbs, even though no login is needed. If you use breadcrumb markup from the plugin on a search template, you are the case the record describes.

What is CVE-2026-85492?#

It is a DOM-based cross-site scripting flaw reached through a URL pathname. The record lists versions up to and including 5.0.1.1 and scores it 6.1, also medium. It names insufficient input sanitization and output escaping as the cause.

Exploitation is narrower still. The victim must hold the aioseo_manage_seo capability and open the SEO Preview panel in the admin toolbar while visiting a page with a crafted URL, per the record. Montti points out that visiting such a URL is not enough on its own.

Which version fixes them?#

The Wordfence records state the affected ranges, not the patched release. The fixed versions come from the plugin’s changelog on WordPress.org, which Montti also quotes:

• 5.0.2: lists “Improved security and access protections in SEO Revisions, SEO Analysis and the SEO Preview”, which is the release the record’s changeset reference points to for the scripting flaw.
• 5.0.2.1: lists “Improved security protections for shortcodes on search pages”, the fix for the shortcode flaw.

A site on 5.0.2 therefore has the scripting fix but not the shortcode fix. The plugin directory listed 5.0.3 as the latest release when we checked, dated 7 October 2026, so a current install is past both.

What should site owners do?#

Update the plugin to 5.0.2.1 or later, which is also Montti’s recommendation. Open Plugins in the WordPress admin, confirm the AIOSEO version, and update if it shows 5.0.2 or lower.

Neither record describes active attacks, and both flaws need conditions that many sites will not meet: breadcrumbs on a search template for the first, a privileged user opening the preview on a crafted link for the second. That is a reason to update on your normal schedule this week, not a reason to panic. For where this fits in a site’s wider health, see technical SEO.