CVE-2021-24307-all-in-one-seo-pack-admin-rce

Admin PHP unserialization RCE in All in one SEO pack CVE-2021-24307 Simple PoC of an admin authenticated RCE in AISEO = 4.1.0.1 provided as an example. Full write-up here: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Usage: php exploit.php u...

CVE-2026-54868

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7...

CVE-2026-54868 WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7...

CVE-2026-54868

The FolioVision FV Simpler SEO plugin (fv-all-in-one-seo-pack) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) . This issue, identified as CWE-79 , stems from the improper neutralization of input during web page generation . The vulnerability impacts versions from n/a through 1.9...

EUVD-2026-98297

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7...

WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by mak3bread in WordPress Plugin All In One SEO Pack versions = 5.0.1.1...

WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin All In One SEO Pack versions = 5.0.2...

CVE-2026-100152

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

EUVD-2026-91907

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

CVE-2026-100152

The All in One SEO WordPress plugin (versions up to and including 5.0.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the software's failure to properly validate a value before passing it to the do_shortcode function. An attacker can exploit this by triggeri...

CVE-2026-100152 All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

CVE-2026-100152 All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

CVE-2026-100152: Improper Control of Generation of Code

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

PT-2026-104498

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.3 Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because it fails to properly validate a value before running the do shortcode function. This issue occurs when the...

CVE-2026-19856

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

EUVD-2026-91769

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2026-19856 All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2026-19856 All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2026-19856

The All in One SEO WordPress plugin versions prior to 5.0.2.1 contains a vulnerability where it fails to correctly identify which shortcodes are present in content derived from user input before stripping them. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on t...

CVE-2026-85492

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...