PT-2026-104498 · WordPress · All In One Seo
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
All in One SEO versions prior to 5.0.3
Description
The plugin allows unauthenticated attackers to execute arbitrary shortcodes because it fails to properly validate a value before running the
do shortcode() function. This issue occurs when the AIOSEO breadcrumb is rendered on the search results page through a block, widget, shortcode, or template tag.Recommendations
Update to version 5.0.3 or later.
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
All In One Seo