# All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Exposure via Smart Tag Injection in Search Query and Request URL

- **ID:** WPSEC-2026-1531
- **Plugin:** All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) (`all-in-one-seo-pack`), https://wordpress.org/plugins/all-in-one-seo-pack/
- **Affected versions:** all versions before 5.0.4
- **Fixed in:** 5.0.4 (Update to 5.0.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/all-in-one-seo-pack
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1531/

## Description

The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via smart tag injection in all versions up to, and including, 5.0.3. This is due to the search query and the raw request path being placed into the schema title, description and URL without encoding the smart tag denotation character, and that output then being parsed again for smart tags. This makes it possible for unauthenticated attackers to inject smart tags such as custom field tags into a search string or URL path and have the rendered JSON-LD schema expand them, exposing post meta values and other data resolved by smart tags.

## References

- https://wpsec.com/vuln/WPSEC-2026-1531/
- https://plugins.svn.wordpress.org/all-in-one-seo-pack/tags/5.0.4/
- https://wordpress.org/plugins/all-in-one-seo-pack/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1531/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.