All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via Search Query
- ID
- WPSEC-2026-0354
- Plugin
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) (all-in-one-seo-pack)
- Affected
- all versions before 5.0.2.1
- Remediation
- Update to 5.0.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- All in One SEO on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-100152, on 2026-10-02.
Description
The All in One SEO plugin for WordPress is vulnerable to arbitrary shortcode execution via the search query ('s' parameter) in all versions up to, and including, 5.0.2. This is due to the plugin inserting the search term, with its square brackets intact, into the search results page title (through the #search_term smart tag that the default search title format uses) and into the search breadcrumb, both of which are then processed for shortcodes, and to a shortcode allow-list that could be bypassed. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on the site by visiting a crafted search URL, including in the default configuration. It also allows them to trigger unbounded recursion through the plugin's own breadcrumbs shortcode, exhausting server resources for that request.
References
- https://wpsec.com/vuln/WPSEC-2026-0354/
- https://plugins.svn.wordpress.org/all-in-one-seo-pack/tags/5.0.2.1/
- https://wordpress.org/plugins/all-in-one-seo-pack/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS