CVE-2026-82884
Received Received - Intake

Stored XSS in All in One SEO WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privileged user edits the post.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-82884
EUVD
EUVD-2026-70045

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
all_in_one_seo all_in_one_seo to 5.0.0.1 (exc)
all_in_one_seo plugin to 5.0.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the All in One SEO WordPress plugin affecting versions before 5.0.0.1. It allows users with contributor role or higher to inject malicious scripts into posts via the ai-assistant block. The scripts execute when a higher-privileged user edits the post.

Detection Guidance

Check if your All in One SEO plugin version is below 5.0.0.1. Log in as a contributor or higher and inspect posts containing the ai-assistant block for unusual scripts. Review server logs for suspicious post edits or script injections.

Impact Analysis

An attacker could inject malicious scripts that execute when a privileged user edits the post. This could lead to unauthorized actions, such as stealing sensitive data, modifying content, or taking control of the WordPress admin panel.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using the affected plugin may face compliance violations and potential legal consequences.

Mitigation Strategies

Update the All in One SEO plugin to version 5.0.0.1 or later immediately. Remove any untrusted scripts from posts and restrict contributor roles to trusted users. Monitor for unauthorized post modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82884. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart