All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Exposure via Smart Tag Injection in Search Query and Request URL
- ID
- WPSEC-2026-1531
- Plugin
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) (all-in-one-seo-pack)
- Affected
- all versions before 5.0.4
- Remediation
- Update to 5.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-74
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-23
- Attack surface
- All in One SEO on WPSec AttackSurface
- Fix released
- Published
Description
The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via smart tag injection in all versions up to, and including, 5.0.3. This is due to the search query and the raw request path being placed into the schema title, description and URL without encoding the smart tag denotation character, and that output then being parsed again for smart tags. This makes it possible for unauthenticated attackers to inject smart tags such as custom field tags into a search string or URL path and have the rendered JSON-LD schema expand them, exposing post meta values and other data resolved by smart tags.
References
- https://wpsec.com/vuln/WPSEC-2026-1531/
- https://plugins.svn.wordpress.org/all-in-one-seo-pack/tags/5.0.4/
- https://wordpress.org/plugins/all-in-one-seo-pack/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS