CVE-2026-19856: All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
All in One SEO WordPress pluginto a version that resolves this vulnerability.Fixed in 5.0.2.1
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites running All in One SEO versions earlier than 5.0.2.1 are affected. Sites that were upgraded from older plugin versions are especially exposed because the shortcode protection is disabled outright.
Does an attacker need an account or user interaction to exploit this?
No. The issue is reachable by an unauthenticated attacker and does not require user interaction.
What can an attacker execute?
An attacker can execute arbitrary shortcodes that are registered on the affected WordPress site. The impact therefore depends on which shortcodes are available in that site's configuration and installed components.
Is specially crafted input always required?
Not on sites upgraded from older versions: the protection is disabled outright, making the issue reachable without crafted input. Other affected installations may require crafted input to bypass the shortcode stripping logic.