CVE-2026-109367

Name of the Vulnerable Software and Affected Versions All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) versions prior to 5.0.4

Description An issue exists that allows unauthenticated attackers to extract arbitrary non-public post meta values. This occurs when sensitive custom fields, such as API keys and internal notes, are emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema via the s parameter.

Recommendations Update the plugin to version 5.0.4 or later. Avoid using the s parameter in the affected plugin until the update is applied.