All in One SEO < 4.6.1.1 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

PoC

As a contributor, create a post and put the following payload in the “Meta Description” field: Save the post (as a draft or submit for review), the XSS will be triggered when any user (like an admin) edit the post again