CVE-2026-82884: All in One SEO WordPress XSS Vulnerability

CVE-2026-82884 Overview

CVE-2026-82884 is a Stored Cross-Site Scripting (XSS) vulnerability in the All in One SEO WordPress plugin before version 5.0.0.1. The plugin fails to sanitize and escape content stored in posts before rendering it back in the post editor. Contributors and higher-privileged users can inject malicious JavaScript that executes when an editor or administrator opens the affected post. This weakness is classified under CWE-79.

Critical Impact
Authenticated contributors can trigger script execution in the browser session of higher-privileged users, enabling account takeover of editors and administrators.

Affected Products

All in One SEO WordPress plugin versions prior to 5.0.0.1

Discovery Timeline

2026-09-02 - CVE-2026-82884 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82884

Vulnerability Analysis

The All in One SEO plugin stores user-supplied content within WordPress posts for SEO metadata handling. The plugin renders this stored content back into the post editor interface without applying output sanitization or escaping. When a higher-privileged user, such as an editor or administrator, opens a post authored or modified by a contributor, injected payloads execute in the victim's authenticated session.

The vulnerability requires authentication at the contributor role or higher. Exploitation depends on user interaction from a privileged victim who edits the compromised post. Successful exploitation runs arbitrary JavaScript in the WordPress admin context, allowing session theft, forced actions via the REST API, or persistence through malicious plugin or user creation.

Root Cause

The root cause is missing input sanitization and output escaping on post content fields processed by the plugin. The plugin trusts stored data and injects it into the editor DOM without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

An authenticated attacker with contributor privileges crafts a post containing a JavaScript payload embedded in a field handled by the plugin. The payload persists in the database. When an administrator or editor opens the post in the editor, the plugin renders the payload unescaped, triggering script execution under the victim's session cookies.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-82884

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror, or javascript: URIs stored in wp_posts or plugin-specific post meta fields.
Unauthorized changes to WordPress user roles, new administrator accounts, or plugin installations following contributor activity.
Outbound requests from admin browser sessions to attacker-controlled domains after post edits.

Detection Strategies

Audit wp_posts and wp_postmeta tables for HTML tags and JavaScript patterns within fields managed by the All in One SEO plugin.
Monitor WordPress audit logs for contributor accounts creating or updating posts immediately followed by administrator edits.
Inspect browser Content Security Policy (CSP) violation reports for inline script executions in /wp-admin/ pages.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record post creation, edits, and role changes with user attribution.
Alert on new administrator account creation or plugin installations that follow contributor-authored post edits.
Review web server logs for suspicious admin-ajax.php and REST API calls originating from admin sessions.

How to Mitigate CVE-2026-82884

Immediate Actions Required

Upgrade the All in One SEO plugin to version 5.0.0.1 or later on all WordPress installations.
Review contributor and author accounts, disabling any that are unused or unrecognized.
Audit recent posts for injected script content and clean affected records.

Patch Information

The vendor addressed the issue in All in One SEO version 5.0.0.1. Refer to the WPScan Vulnerability Report for advisory details and remediation confirmation.

Workarounds

Restrict contributor role assignment to trusted users only until patching is complete.
Deploy a Web Application Firewall (WAF) with rules that block script tags and event handler attributes in POST bodies targeting /wp-admin/post.php.
Implement a strict Content Security Policy on WordPress admin pages to block inline script execution.

bash

# Update the plugin via WP-CLI
wp plugin update all-in-one-seo-pack --version=5.0.0.1
wp plugin list --name=all-in-one-seo-pack --fields=name,version,status