CVE-2026-100152: All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites running All in One SEO version 5.0.2 or earlier are exposed only when the AIOSEO breadcrumb is rendered on search-results pages through a block, widget, shortcode, template tag, or equivalent configured output.
Does an attacker need an account or user interaction?
No. The vulnerability is remotely exploitable without authentication, privileges, or user interaction through the search query parameter.
What security impact can exploitation have?
The reported severity vector indicates low confidentiality and integrity impact, with no availability impact. Exploitation enables execution of arbitrary shortcodes rather than direct server-side code execution as stated in the available data.
How can I determine whether a site is currently at risk?
Check whether the installed All in One SEO version is 5.0.2 or earlier, then test or review the search-results template and configuration to determine whether an AIOSEO breadcrumb is rendered there.