{"error":0,"message":null,"data":{"name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","plugin":"all-in-one-seo-pack","link":"https:\/\/wordpress.org\/plugins\/all-in-one-seo-pack\/","latest":"1790882940","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"11b4b32842d03f4cf1bd05ce98a822e66a5e6925e563baf3fa7f42086ad3bd48","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.1.5.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.5.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-25036","name":"CVE-2021-25036","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-25036","description":"[en] The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn\u2019t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.","date":"2022-01-17"},{"id":"0344f75547cbdf6d562a8edf7a8ed354947108c4","name":"WordPress All in One SEO plugin <= 4.1.5.2 - Authenticated Privilege Escalation vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-plugin-4-1-5-2-authenticated-privilege-escalation-vulnerability","description":"Authenticated Privilege Escalation vulnerability discovered by Marc Montpas in WordPress All in One SEO plugin (versions <= 4.1.5.2).","date":"2021-12-14"},{"id":"6de4a7de-6b71-4349-8e52-04c89c5e6d6c","name":"All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation","link":"https:\/\/wpscan.com\/vulnerability\/6de4a7de-6b71-4349-8e52-04c89c5e6d6c","description":"The plugin is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.","date":null},{"id":"3999cd67c7e5c040845032dceb84bd4c7aadc360","name":"All in One SEO 4.0.0 - 4.1.5.2 Authorization Bypass","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-400-4152-authorization-bypass","description":"The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn\u2019t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.","date":"2021-12-14"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-178","name":"Improper Handling of Case Sensitivity","description":"The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results."},{"cwe":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct."}]}},{"uuid":"51e5df31c128f82620ad04355951c0bbd901dbe7365fe5c04dd7007ce9e3f93a","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.1.5.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.5.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-25037","name":"CVE-2021-25037","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-25037","description":"[en] The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site\u2019s database (e.g., usernames and hashed passwords).","date":"2022-01-17"},{"id":"ecdbe4d913835f4ac9d038ebbee27f89aba5ef27","name":"WordPress All in One SEO plugin <= 4.1.5.2 - Authenticated SQL Injection (SQLi) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-plugin-4-1-5-2-authenticated-sql-injection-sqli-vulnerability","description":"Authenticated SQL Injection (SQLi) vulnerability discovered by Marc Montpas in WordPress All in One SEO plugin (versions <= 4.1.5.2).","date":"2021-12-14"},{"id":"4cd2a57b-3e1a-4acf-aecb-201ed9f4ee6d","name":"All In One SEO < 4.1.5.3 - Authenticated SQL Injection","link":"https:\/\/wpscan.com\/vulnerability\/4cd2a57b-3e1a-4acf-aecb-201ed9f4ee6d","description":"The plugin is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).","date":null},{"id":"e0193b4e877f95bf6c474e57fccb253af6a68409","name":"All in One SEO 4.1.3.1 - 4.1.5.2 - Authenticated SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-4131-4152-authenticated-sql-injection","description":"The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site\u2019s database (e.g., usernames and hashed passwords).","date":"2021-12-14"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}]}},{"uuid":"9ef90f55799e49eb9e510e5f1bf1bd67d672d549e858281431c436a9833d037c","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.1.0.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.0.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24307","name":"CVE-2021-24307","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24307","description":"[en] The All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with \"aioseo_tools_settings\" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section \"Tool > Import\/Export\". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.","date":"2021-05-24"},{"id":"f19f1e9b99b4cad002ab9cdeb9249a2f41ebe511","name":"WordPress All In One SEO Pack plugin <= 4.1.0.1 - Authenticated Remote Code Execution (RCE) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-4-1-0-1-authenticated-remote-code-execution-rce-vulnerability","description":"Authenticated Remote Code Execution (RCE) vulnerability discovered by darkpills in WordPress All In One SEO Pack plugin (versions <= 4.1.0.1).","date":"2021-05-09"},{"id":"ab2c94d2-f6c4-418b-bd14-711ed164bcf1","name":"All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize","link":"https:\/\/wpscan.com\/vulnerability\/ab2c94d2-f6c4-418b-bd14-711ed164bcf1","description":"The plugin enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import\/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution. \r\n\r\nAs exploitation requires high privileges, the main threat scenario concerns attackers willing to compromise system host on mutualized wordpress platform where plugin installation has been denied by security hardening by hosting provider (DISALLOW_FILE_MODS=true in config).","date":null},{"id":"e4e95cbf97c839d4aedf8e69ccab833bd371eb91","name":"All in One SEO <= 4.1.0.1 - Authenticated Code Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-4101-authenticated-code-injection","description":"The All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with \"aioseo_tools_settings\" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section \"Tool > Import\/Export\". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.","date":"2021-05-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}]}},{"uuid":"252ac53328c3d8463c72911aa212c202f0d31cf9dfde12bc9ab98f140d433381","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 3.6.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.6.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2020-35946","name":"CVE-2020-35946","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2020-35946","description":"[en] An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor, leading to stored XSS.","date":"2021-01-01"},{"id":"5b8cf8852fcbf4c5cd151900250ae08eb815e266","name":"WordPress All In One SEO Pack plugin <= 3.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-3-6-1-authenticated-stored-cross-site-scripting-xss-vulnerability","description":"Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by WordFence in WordPress All In One SEO Pack plugin (versions <= 3.6.1).","date":"2020-07-16"},{"id":"528fff6c-54fe-4812-9b08-8c4e47350c83","name":"All in One SEO Pack < 3.6.2 - Authenticated Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/528fff6c-54fe-4812-9b08-8c4e47350c83","description":"This flaw allowed authenticated users with contributor level access or above the ability to inject malicious scripts that would be executed if a victim accessed the wp-admin panel’s ‘all posts’ page.","date":null},{"id":"0646cd94aae115864bbaf69d120079bab6a7aeb5","name":"All in One SEO Pack <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-361-authenticated-contributor-stored-cross-site-scripting","description":"An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor, leading to stored XSS.","date":"2020-07-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"c12ddf3bfb5c46bfdeebe76b6610a205ad03d8cc739da3ad2fae9df500f65eda","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.0.3.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.3.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2013-5988","name":"CVE-2013-5988","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2013-5988","description":"[en] A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.","date":"2020-02-11"},{"id":"0ddc6e3f-8a02-43d9-ba63-e3d94e7b0a1b","name":"All in One SEO Pack <= 2.0.3 - XSS","link":"https:\/\/wpscan.com\/vulnerability\/0ddc6e3f-8a02-43d9-ba63-e3d94e7b0a1b","description":"The All in One SEO Pack WordPress plugin was affected by a XSS security vulnerability.","date":null},{"id":"01aa7efa6c781720483bf1c7fb02f508dc4cd0fe","name":"All in One SEO <= 2.0.3 - Cross-Site Scripting via Search Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-203-cross-site-scripting-via-search-parameter","description":"A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.","date":"2014-08-01"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"7e82d3d01308501bf330d3745122e3d2492f55d2a0ebf3bb06673b0b8d104906","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 3.2.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.2.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2019-16520","name":"CVE-2019-16520","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2019-16520","description":"[en] The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.","date":"2019-10-16"},{"id":"868dccee-089b-43d2-a80a-6cadba91f770","name":"All In One SEO Pack < 3.2.7 - Stored Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/868dccee-089b-43d2-a80a-6cadba91f770","description":"The All in One SEO Pack WordPress plugin was affected by a Stored Cross-Site Scripting (XSS) security vulnerability.","date":null},{"id":"b5064dcbcb704dd27c772690a8dbaf995e6a9a09","name":"All In One SEO Pack <= 3.2.6 - Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-326-stored-cross-site-scripting","description":"The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.","date":"2019-10-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"a92390e98773ade5b73caa9bb26d6ed296eaf44cfe6de9df3214c94232ddf3f8","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.2.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2015-0902","name":"CVE-2015-0902","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2015-0902","description":"[en] The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.","date":"2015-04-03"},{"id":"JVNDB-2015-000046","name":"All in One SEO Pack information management vulnerability","link":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2015-000046","description":"All in One SEO Pack is a WordPress plugin. All in One SEO Pack automatically adds a meta tag (\"Meta Description\") to a page using some part of its contents, and this behavior is enabled in the initial configuration. Meta Description can be added even when a page is password-protected, therefore some part of its contents are not protected. Fumito MIZUNO of rescuework.inc reported this vulnerability to IPA. JPCERT\/CC coordinated with the developer under Information Security Early Warning Partnership.","date":"2015-03-31"},{"id":"5efeef40a0da20148f1cd3ded6b15c43644bfaac","name":"WordPress All in One SEO Pack Plugin <= 2.2.5 - Information Management","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-2-2-5-information-management","description":"All in One SEO Pack plugin is prone to an information management vulnerability. The attackers can obtain sensitive information by reading HTML source code, because this plugin does not consider the presence of password protection during generation of the Meta Description field.\nUpdate the plugin.","date":"2015-01-08"},{"id":"de4706de-f388-41b9-af91-bd4677a7166e","name":"All in One SEO Pack <= 2.2.5.1 - Information Disclosure","link":"https:\/\/wpscan.com\/vulnerability\/de4706de-f388-41b9-af91-bd4677a7166e","description":"The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.","date":null},{"id":"56ac5058607b9b17d0a051b742f0f63fb854071c","name":"All in One SEO <= 2.2.5.1 - Information Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-2251-information-disclosure","description":"The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.","date":"2015-03-31"}],"impact":{"cvss":{"version":null,"vector":null,"av":null,"ac":null,"pr":null,"ui":null,"s":null,"c":null,"i":null,"a":null,"score":"0.0","severity":null,"exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}]}},{"uuid":"64d7067d0d7ae9dabd4e5813129e9f2b4759c914912804f5f671612ed164464b","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.3.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"be315b0303a75217b959c25bb227e6c1329b1a1e","name":"WordPress All in One SEO Pack Plugin <= 2.3.6.1 - Stored Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-2-3-6-1-stored-cross-site-scripting","description":"Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code.\nUpdate the plugin.","date":"2016-07-19"}],"impact":[]},{"uuid":"85317a68f1e86586f8ce9d1bc8a16c040178dbcba672b1296c6b1d2b1a6a0012","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.3.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"d13c2bc5806bb2a3e15eda463d7d4ab72392d787","name":"WordPress All in One SEO Pack Plugin <= 2.3.7 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-2-3-7-cross-site-scripting","description":"Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code.\nUpgrade this plugin.","date":"2016-07-19"}],"impact":[]},{"uuid":"6a93a8c702ad956be4e55efd199f1f1fbf5c4ad47ca22ed77171b864d4a1c08d","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.6.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.3.6.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"7516e9f88fcafa2b03d0ff9b541a6d8329fef6c6","name":"WordPress All in One SEO Pack Plugin 2.3.6.1 - Persistent XSS","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-2-3-6-1-persistent-xss","description":"Because of this vulnerability, an attacker can steal administrators session token or perform other arbitrary actions.\nUpdate the WordPress plugin to the newer stable and safe version.","date":"2016-07-11"}],"impact":[]},{"uuid":"eb2f04ae656c5d80733271940fd3deae3d8251839c4c303dcd46e1fe5a528bdc","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.6.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.2.6.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"f0b66901fdcf4e195f91657e338b1db0d8f047ad","name":"WordPress All in One SEO Pack Plugin <= 2.2.6.1 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-2-2-6-1-cross-site-scripting","description":"Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code.\nUpgrade the plugin.","date":"2015-09-09"}],"impact":[]},{"uuid":"ba31b7c4ba7834cbdd985865156871efa618fe63e63a473b0b91c0cedc418113","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"5c21716107f3a3a375a3263b7c0c97b89d7dcc6a","name":"WordPress All in One SEO Pack Plugin <= 2.1.5 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-2-1-5-cross-site-scripting","description":"This plugin is prone to a cross site scripting vulnerability via aioseop_functions.php new_meta parameter.\nUpdate the plugin.","date":"2015-05-15"}],"impact":[]},{"uuid":"bfba9e1752760de9e3ffedd29a739d0fc0fdfaca985511d6d918110efb887ba2","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"484a9f3f7b1967a94bd8d9f2703eb9bf5bf20e6f","name":"WordPress All in One SEO Pack Plugin <= 2.1.5 - Privilege Escalation","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-2-1-5-privilege-escalation","description":"This plugin is prone to an unspecified privilege escalation vulnerability.\nUpdate the plugin.","date":"2015-05-15"}],"impact":[]},{"uuid":"b0321fbc496f413830c745700345e6877c88c20b7404c18cee8d099a7f689a12","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.2.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.2.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-38093","name":"CVE-2022-38093","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-38093","description":"[en] Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.","date":"2022-09-09"},{"id":"15f106ff64e5045c79db42aa2575c21a46f212ba","name":"WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-plugin-4-2-3-1-multiple-cross-site-request-forgery-csrf-vulnerabilities","description":"Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were discovered by Rafie Muhammad aka Yeraisci (Patchstack Alliance) in The WordPress All in One SEO plugin (versions <= 4.2.3.1).\nUpdate the WordPress All In One SEO Pack plugin to the latest available version (at least 4.2.4).","date":"2022-09-05"},{"id":"1b218b7c8e92599b0167fb5ca042b50d17d55880","name":"All in One SEO <= 4.2.3.1 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-4231-cross-site-request-forgery","description":"The All in One SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.2.3.1. This is due to missing or incorrect nonce validation on several of its functions. This makes it possible for unauthenticated attackers to execute them, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2022-09-05"},{"id":"5f31b537-186d-424c-a0c3-56f29146bb6e","name":"All in One SEO < 4.2.4 - Multiple CSRF","link":"https:\/\/wpscan.com\/vulnerability\/5f31b537-186d-424c-a0c3-56f29146bb6e","description":"The plugin does not have CSRF check in some places, which could allow attackers to make logged in users perform unwanted actions","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"l","score":"5.4","severity":"m","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:L","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"low","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"0f97e81e3326213b10ea8de2863d0488436cb11c8e6cdb89616481cdb0179c74","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.10","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.10","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"16353d45-75d1-4820-b93f-daad90c322a8","name":"All in One SEO Pack <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/16353d45-75d1-4820-b93f-daad90c322a8","description":"The All in One SEO Pack WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability.","date":null}],"impact":[]},{"uuid":"4645719c914d25a477111f3196e2d89e2d00e95b401ffc8062a4077ae0f500d0","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.3.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"42a98395-e4e4-47a5-b758-2b76b7c4885a","name":"All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/42a98395-e4e4-47a5-b758-2b76b7c4885a","description":"The All in One SEO Pack WordPress plugin was affected by a Unauthenticated Stored Cross-Site Scripting (XSS) security vulnerability.","date":null}],"impact":[]},{"uuid":"e3f968a33a0b1a78acd1af2d438f968a6e41b112028ff702edb21ce89525b2f7","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.3.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"aa790e24-ae9d-48b9-8071-7ca138cdc69d","name":"All in One SEO Pack <= 2.3.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/aa790e24-ae9d-48b9-8071-7ca138cdc69d","description":"Requires 'Track Blocked Bots setting' to be enabled which it is not by default.","date":null}],"impact":[]},{"uuid":"e2c7ba50fbc5d16a69d0f95343c740d803eed89f7f8e554b95dd20b54c192857","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.6.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.2.6.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"9c76c04d-3c4e-4a06-ab7e-054bc21c55fc","name":"wpscan.com","link":"https:\/\/wpscan.com\/vulnerability\/9c76c04d-3c4e-4a06-ab7e-054bc21c55fc","description":null,"date":null}],"impact":[]},{"uuid":"3efdcc2e00c68cf9f5644cef6701862ee24debb2633afa997119630906f52de2","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"845a890f-1c56-4075-a717-c9627586cbbe","name":"All in One SEO Pack <= 2.1.5 - aioseop_functions.php new_meta Parameter XSS","link":"https:\/\/wpscan.com\/vulnerability\/845a890f-1c56-4075-a717-c9627586cbbe","description":"The All in One SEO Pack WordPress plugin was affected by an aioseop_functions.php new_meta Parameter XSS security vulnerability.","date":null}],"impact":[]},{"uuid":"154012b1e9ffc272319fc313fcc6bde4b5b6545f09e23929c1ddfd14e31137f9","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"3a79a32d-2744-41c5-8752-0540f744e25d","name":"All in One SEO Pack <= 2.1.5 - Unspecified Privilege Escalation","link":"https:\/\/wpscan.com\/vulnerability\/3a79a32d-2744-41c5-8752-0540f744e25d","description":"The All in One SEO Pack WordPress plugin was affected by an Unspecified Privilege Escalation security vulnerability.","date":null}],"impact":[]},{"uuid":"a3aa81b9c68dc791b9b9a3964dc1f91a245eac308c03794aca0a6092b0f031c3","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.10","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.10","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"3ba807ccfacfcb7a0533e3c9d7970536d7380445","name":"All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-2911-authenticated-stored-cross-site-scripting","description":"The All in One SEO plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including 2.9.1.1, via post meta values. This makes it possible for attackers with Contributor level permissions and above to inject arbitrary web scripts in administrative pages that execute whenever a user accesses the page with the stored web scripts.","date":"2018-10-18"}],"impact":[]},{"uuid":"eeb64da477e43023b6a95083a829a7728ad6d357ccdccf64c07e185f402f9c1c","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.3.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"a32fbfc28c93ef3110ed89cda027e1f3df613f67","name":"All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-237-unauthenticated-stored-cross-site-scripting","description":"The All in One SEO Pack plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting via unspecified vectors that make it possible for attackers to inject arbitrary web scripts into web pages that will execute when a victim accesses the page in versions up to, and including, 2.3.7. \r\n\r\nPlease note that this exploit only works if the user has enabled the sitemap module in the plugin.","date":"2016-07-13"}],"impact":[]},{"uuid":"c3e670cbbc4c7257e5e7a0f1b39d929a10e23683e1572ca26851dd865aed186d","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.3.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"975a2669a2db11f3fa8a69746c8be9253d8a060f","name":"All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic <= 2.3.6 - Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-best-wordpress-seo-plugin-easily-improve-seo-rankings-increase-traffic-236-stored-cross-site-scripting","description":"The All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP_REFERER header in versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2016-07-01"}],"impact":[]},{"uuid":"f967e51cbb1c95a7b7a4810e5cf4c1032b290ea51a0c0781bf17f0ce19bc3ff4","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.6.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.2.6.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"99cef9ace89776148234e4f94912711aab354a3a","name":"All in One SEO <= 2.2.6.1 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-2261-reflected-cross-site-scripting","description":"The All in One SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.2.6.1 due to insufficient input sanitization and output escaping on add_query_arg and remove_query_arg. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.","date":"2015-04-20"}],"impact":[]},{"uuid":"f4afdd785a1714025a82c6d3e33e55952b79acca9d0b1ba18cb42cfdd4af2fb6","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.2.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"cf9a6262a1b6cbbfceb42f683a61bda04835f180","name":"All in One SEO <= 2.2.4.1 - Privilege Escalation to Arbitrary Post Modification","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-2241-privilege-escalation-to-arbitrary-post-modification","description":"The All in One SEO plugin for WordPress is vulnerable to Authenticated Privilege Escalation leading to Post Changes in versions up to, and including, 2.2.4.1. This is due to certain actions being available to low-privileged users. This makes it possible for Subscriber-level attackers to add or modify certain parameters used by the plugin. This includes the post\u2019s SEO title, description and keyword meta tags. This could be used to decrease a site's Search Engine Results Page (SERP) ranking.","date":"2014-05-31"}],"impact":[]},{"uuid":"797c57d433a6113034412b5db6989fb493bd0e20fe935121c5f8c3a5a5cc2668","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6f351bbd478531d8361126335b04afe8d56a098f","name":"All in One SEO <= 2.1.5 - Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-215-cross-site-scripting","description":"The All in One SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SEO settings for posts in versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2014-05-31"}],"impact":[]},{"uuid":"47ebb01c66d9f8934bfd5c93a98d106a20613ab56c283b5d7856df5a92a167a2","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"8327743a0a9105aea318021a17da44155e980487","name":"All in One SEO <= 2.1.5 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-215-missing-authorization","description":"The All in One SEO plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the aioseop_ajax_save_meta() function in versions up to, and including, 2.1.5. This makes it possible for authenticated attackers with subscriber level permissions and above to modify some of the SEO settings of the plugin for any given post.","date":"2014-05-31"}],"impact":[]},{"uuid":"fe88d49552b6a283b91a31fbeab119f759433b73d1e5cc65616294ffd992a8cb","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.3.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.3.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-0586","name":"CVE-2023-0586","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-0586","description":"[en] The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2023-02-24"},{"id":"d8497c5b64492d388980383146cc19550d418eac","name":"All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-429-authenticated-contributor-stored-cross-site-scripting","description":"The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2023-02-24"},{"id":"0f3e72178453ef8ab55c3b0c29dd7f2a5a8728bb","name":"WordPress All In One SEO Pack Plugin <= 4.2.9 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-4-2-9-authenticated-contributor-stored-cross-site-scripting-vulnerability","description":"Update the WordPress All In One SEO Pack plugin to the latest available version (at least 4.3.0).\nIvan Kuzymchak discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress All In One SEO Pack Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.3.0.","date":"2023-02-27"},{"id":"e2e78948-81cc-49e4-9a68-1a989a4a0585","name":"All in One SEO Pack < 4.3.0 - Contributor+ Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/e2e78948-81cc-49e4-9a68-1a989a4a0585","description":"The plugin does not sanitise and escape multiple parameters, which could allow users with a role as low as contributor to perform Stored XSS attacks","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"34636edcccdc8e1ba212f8027f92dd1c435bddeadf3b15d58291b22fe4afc5f4","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.3.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.3.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-0585","name":"CVE-2023-0585","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-0585","description":"[en] The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2023-02-24"},{"id":"6a883923256ef595a6c115e0c9884781612276bf","name":"All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-429-authenticated-administrator-stored-cross-site-scripting","description":"The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2023-02-24"},{"id":"f0f061ecb2f732e241128affa0eeb54b2c55b8b9","name":"WordPress All In One SEO Pack Plugin <= 4.2.9 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-4-2-9-authenticated-administrator-stored-cross-site-scripting-vulnerability","description":"Update the WordPress All In One SEO Pack plugin to the latest available version (at least 4.3.0).\nWordFence discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress All In One SEO Pack Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.3.0.","date":"2023-02-27"},{"id":"3ace429e-42a8-4b1b-8a39-5262f289cbd9","name":"All in One SEO Pack < 4.3.0 - Admin+ Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/3ace429e-42a8-4b1b-8a39-5262f289cbd9","description":"The plugin does not sanitise and escape multiple parameters, which could allow high privilege users such as admin to perform Stored XSS attacks even when unfiltered_html is disallowed","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"c275daaf41e3991fdea3cba202a6a9f842702ba420386d1f17539993c0c5fe7a","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.6.1.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.6.1.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-3554","name":"CVE-2024-3554","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-3554","description":"[en] The All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-05-02"},{"id":"2b839ff2ed5ca1954a5f8edc192cfd3346a6172a","name":"All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-best-wordpress-seo-plugin-easily-improve-seo-rankings-increase-traffic-460-authenticated-contributor-stored-cross-site-scripting-via-shortcode","description":"The All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-04-29"},{"id":"e636edec176b158b1ac7bbc559b282e5d2172060","name":"WordPress All In One SEO Pack Plugin <= 4.6.0 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-best-wordpress-seo-plugin-easily-improve-seo-rankings-increase-traffic-plugin-4-6-0-authenticated-contributor-stored-cross-site-scripting-via-shortcode-vulnerability","description":"

WordPress All In One SEO Pack Plugin <= 4.6.0 is vulnerable to Cross Site Scripting (XSS)<\/p>

Software: All In One SEO Pack<\/p>

Link: https:\/\/wordpress.org\/plugins\/all-in-one-seo-pack\/#developers<\/p>

Affected Version <= 4.6.0<\/p>

Fixed in version 4.6.1.1 <\/p>","date":"2024-04-29"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."},{"cwe":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as \"<\", \">\", and \"&\" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"2c4bd7ef607a04215d27ed64925b14ccc5038e02dc5a9ce3cba1ded2fcf65b78","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.6.1.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.6.1.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-3368","name":"CVE-2024-3368","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-3368","description":"[en] The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks","date":"2024-05-20"},{"id":"78882e69c3b4140343b347fd105f26e278bee07e","name":"All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-460-authenticated-contributor-stored-cross-site-scripting","description":"The All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the meta description in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-04-29"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"94615f83736ecf6626b4a5a8d147a50566c1b9365ea971c8346ac19ccbe4fe47","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.8.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-2892","name":"All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-2892","description":"The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"0000-00-00"},{"id":"94d7cb11cd4185ec6048bf53ba726fd1334dd2ad","name":"All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-4811-authenticated-contributor-stored-cross-site-scripting-via-post-meta-description-and-canonical-url","description":"The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-05-18"},{"id":"75ad7d9e3f3fb125ea2c53a861faab2b8066541e","name":"WordPress All In One SEO Pack Plugin <= 4.8.1.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-seo-pack\/vulnerability\/wordpress-all-in-one-seo-pack-plugin-4-8-1-1-authenticated-contributor-stored-cross-site-scripting-via-post-meta-description-and-canonical-url-vulnerability","description":"

WordPress All In One SEO Pack Plugin <= 4.8.1.1 is vulnerable to Cross Site Scripting (XSS)<\/p>

Software: All In One SEO Pack<\/p>

Fixed in version 4.8.2 <\/p>

Affected Version <= 4.8.1.1<\/p>

CVE: CVE-2025-2892<\/p>","date":"2025-05-19"},{"id":"EUVD-2025-15663","name":"EUVD-2025-15663","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-15663","description":"The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-05-19"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.001"}},{"uuid":"4c51101419395bc4d0c950acd675a228713cc465e1d093230902f653edc8b298","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-12847","name":"CVE-2025-12847","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-12847","description":"[en] The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `\/wp-json\/aioseo\/v1\/ai\/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.","date":"2025-11-15"},{"id":"fad66d7c00e56719331281351f94913b63c2a734","name":"All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-powerful-seo-plugin-to-boost-seo-rankings-increase-traffic-489-missing-authorization-to-authenticated-contributor-arbitrary-media-deletion","description":"The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `\/wp-json\/aioseo\/v1\/ai\/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.","date":"2025-11-14"},{"id":"EUVD-2025-197686","name":"EUVD-2025-197686","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-197686","description":"The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `\/wp-json\/aioseo\/v1\/ai\/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.","date":"2025-11-15"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"bbd08291872b5d32ae05045c5306aadfb2705af95bc340705944054df1cb9dee","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.1.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.1.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-67950","name":"CVE-2025-67950","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-67950","description":"[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Blind SQL Injection.This issue affects All In One SEO Pack: from n\/a through <= 4.9.1.","date":"2025-12-16"},{"id":"99019238554ef9c82f30094e33c6c5106a634d80","name":"All In One SEO Pack <= 4.9.1 - Authenticated (Contributor+) SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-491-authenticated-contributor-sql-injection","description":"The All In One SEO Pack plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2025-12-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:N\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"h","i":"n","a":"l","score":"8.5","severity":"h","exploitable":"1.8","impact":"6.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:N\/A:L","score":"8.5","severity":"high","av":"network","ac":"low","pr":"low","ui":"none","s":"changed","c":"high","i":"none","a":"low","exploitable":"1.8","impact":"6.0"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"da5e2a04548f27583b0783680bc7c244721e365275dd18e00c99f8e5d286c0d0","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.8.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-64295","name":"CVE-2025-64295","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-64295","description":"[en] Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n\/a through <= 4.8.6.1.","date":"2025-12-18"},{"id":"3b07a02885e8caae5cb0647732da1bd629aa9f8f","name":"All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-4861-authenticated-subscriber-information-exposure","description":"The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.8.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.","date":"2025-11-26"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-201","name":"Insertion of Sensitive Information Into Sent Data","description":"The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"24898168beb7c77ad952d89aef627c461bd0bdaeafd51566b1718ec9227f9f3a","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-14384","name":"CVE-2025-14384","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-14384","description":"[en] The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `\/aioseo\/v1\/ai\/credits` REST route in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disclose the global AI access token.","date":"2026-01-16"},{"id":"46020040782af283c1de391c483374b604b7c88c","name":"All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-powerful-seo-plugin-to-boost-seo-rankings-increase-traffic-492-missing-authorization-to-authenticated-contributor-ai-access-token-and-credit-disclosure","description":"The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `\/aioseo\/v1\/ai\/credits` REST route in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disclose the global AI access token.","date":"2026-01-15"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"3a1328d875f2a29c96d1b8435b0ae5b3087fb1f8ce329976bf7d6b6779724158","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.8.7.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.7.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-58649","name":"WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure Vulnerability","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-58649","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n\/a through <= 4.8.7.1.","date":"0000-00-00"},{"id":"dcaf9e9cc2c772d719e4a15ce8719a94f17421e2","name":"All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-487-authenticated-contributor-sensitive-information-exposure","description":"The All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.8.7.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive user or configuration data.","date":"2025-09-22"},{"id":"EUVD-2025-30551","name":"EUVD-2025-30551","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-30551","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack allows Retrieve Embedded Sensitive Data. This issue affects All In One SEO Pack: from n\/a through 4.8.7.","date":"2025-09-22"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":null,"impact":null}}},{"uuid":"92b042bc3b145416e9e3662c707aa84f434c1187e43ae93bfc352ad0b2d9eafb","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.8.7.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.7.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-58650","name":"CVE-2025-58650","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-58650","description":"[en] Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n\/a through <= 4.8.7.1.","date":"2025-09-22"},{"id":"a37173b296571997504f18f46f17e51b4e9ce9df","name":"All In One SEO Pack <= 4.8.7.1 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-pack-487-missing-authorization","description":"The All In One SEO Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.8.7.1. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.","date":"2025-09-22"},{"id":"EUVD-2025-30547","name":"EUVD-2025-30547","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-30547","description":"Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects All In One SEO Pack: from n\/a through 4.8.7.","date":"2025-09-22"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"l","score":"5.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"fbed325f086c4719866d93937bab9086180809375493cac6c5b049627b06f4ab","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.7.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.7.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-5075","name":"CVE-2026-5075","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-5075","description":"[en] The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and including, 4.9.7 due to sensitive internal option data being passed to wp_localize_script() in post editor contexts without effective masking for low-privilege users. This makes it possible for authenticated attackers, with contributor-level access and above, to view configured API\/OAuth tokens and license-related values from page source.","date":"2026-05-20"},{"id":"3f50b809569039dcd016b0bbcedf59c991cd3c88","name":"All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-497-authenticated-contributor-sensitive-information-exposure-via-internaloptions-localized-script-data","description":"The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and including, 4.9.7 due to sensitive internal option data being passed to wp_localize_script() in post editor contexts without effective masking for low-privilege users. This makes it possible for authenticated attackers, with contributor-level access and above, to view configured API\/OAuth tokens and license-related values from page source.","date":"2026-05-19"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"4.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"682f86bc5a5f45e18ae63bf42f4260b364463f52ba99218999e8eb286e8844f4","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.9","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.9","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-10755","name":"CVE-2026-10755","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-10755","description":"[en] The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.","date":"2026-07-20"},{"id":"e1b2f4069f6c7cecc125e0f1ad8652bf8308f34c","name":"All in One SEO < 4.9.9 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-seo-pack\/all-in-one-seo-499-missing-authorization","description":"The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 4.9.9 (exclusive). This makes it possible for unauthenticated attackers to execute some AI endpoints.","date":"2026-06-29"}],"impact":{"cwe":[{"cwe":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"077c55a37b761f7ab9be4538724910eb64e888ba15fab07bdceddb81558073bb","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 5.0.0.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.0.0.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-82884","name":"CVE-2026-82884","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-82884","description":"[en] The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privileged user edits the post.","date":"2026-09-02"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"h","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"6.8","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"6.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}}]},"updated":"1788502162"}