Executive brief
All in One SEO is a popular WordPress plugin that manages search engine optimization metadata and settings for WordPress sites. A stored cross-site scripting (XSS) vulnerability in the AI Assistant block allows attackers with contributor-level access to inject malicious code into posts that executes when higher-privileged administrators or editors view the post, potentially compromising their accounts and site security.
Technical details
The vulnerability is a stored XSS flaw (CWE-79) in the AI Assistant block component that fails to properly sanitize and escape user-controlled content before rendering it in the WordPress post editor. An attacker with contributor role or higher can inject JavaScript payload within the block's JSON attributes (specifically the "content" field), which is then stored in the post. When an administrator or editor opens the post in the block editor, the unescaped payload executes in their browser session with their privileges. The attack requires the attacker to have contributor-level access to create/modify posts, but impacts higher-privileged users. The vulnerability is fixed in version 5.0.0.1.
Affected products
- All in One SEO All in One SEO before 5.0.0.1
Timeline
- 2026-09-01: disclosed
- 2026-09-02: published
- 2026-09-02: patched: Fixed in version 5.0.0.1