Description

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privileged user edits the post.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-02T15:17:44.553Z",
  "pubdate": "2026-09-02T15:17:44.553Z",
  "executiveSummary": "The All in One SEO WordPress plugin, specifically versions prior to 5.0.0.1, contains a vulnerability categorized as Stored Cross-Site Scripting (XSS).\nThis flaw arises due to the insufficient sanitization and output escaping of data stored within post content, which is subsequently rendered within the WordPress post editor interface.\nThe vulnerability allows an authenticated user with a role of 'Contributor' or higher to inject malicious JavaScript payloads into post metadata or content fields.\nWhen a user with higher administrative privileges accesses the affected post through the WordPress dashboard, the injected script executes within the context of their session.\nThe impact includes potential unauthorized actions performed on behalf of the administrative user, session hijacking, or site-wide configuration changes.\nSuccessful exploitation requires the attacker to have at least 'Contributor' level access to the WordPress instance, making this a vertical privilege escalation vector.\nThis vulnerability poses a significant risk to site integrity and administrative security, as it bypasses standard authorization controls via the compromise of privileged user sessions.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the All in One SEO plugin to properly sanitize user-supplied input or encode data before it is processed by the post editor's rendering engine. In WordPress, the post editor dynamically retrieves and displays stored post meta and content blocks to facilitate the editing experience.\nBecause the plugin does not implement adequate server-side sanitization on these fields, an attacker can supply malicious scripts (e.g., <script>alert(1)</script>) within the affected fields. When this data is stored in the WordPress database and later retrieved by the post editor, the browser treats the stored payload as executable code rather than plain text.\nThe attack flow begins when an authenticated 'Contributor' crafts a malicious payload and embeds it within the plugin's configuration fields associated with a specific post. Once the post is saved, the malicious content remains dormant in the database. The vulnerability is triggered when a privileged user (such as an Administrator or Editor) navigates to the post within the WordPress dashboard to review or edit the content.\nAt the moment the editor loads the post's metadata, the plugin renders the unsanitized input into the Document Object Model (DOM). The browser then executes the embedded JavaScript in the context of the administrator's authenticated session. This execution bypasses Same-Origin Policy (SOP) protections because the script runs on the origin of the administrative dashboard.\nThe post-exploitation impact allows the attacker to perform any action the compromised administrator can perform. This includes, but is not limited to, creating new administrative accounts, modifying plugin settings, redirecting users, or injecting secondary backdoors into theme files. Since the execution occurs within the admin interface, the attacker may also leverage the environment to exfiltrate sensitive cookies or configuration data.\nThe affected component is the logic responsible for the data persistence and rendering of post-specific settings handled by the All in One SEO plugin. The vulnerability exists in all versions strictly prior to 5.0.0.1, and exploitation requires an existing, valid contributor-level session on the WordPress installation."
}