The affected All in One SEO WordPress plugin fails to sanitise and escape user‑supplied input for the Post Meta Description and Canonical URL parameters. This defect allows an authenticated user with Contributor‑level or higher permissions to inject arbitrary JavaScript that is stored and rendered when anyone views the affected page, leading to potential browser‑side attacks such as cookie theft, session hijacking or defacement. The weakness corresponds to CWE‑79, a classic known vulnerability that compromises the integrity and confidentiality of web‑application traffic.

Vendors: smub; Product: All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic. All plugin releases up to and including 4.8.1.1 are affected. Users running any of these versions on WordPress sites with Contributor or higher roles are at risk.

The catalog lists a CVSS score of 6.4, indicating moderate severity. EPSS indicates a probability of exploitation of less than 1% at the time of assessment, and the vulnerability is not included in CISA’s KEV list. The likely attack vector is through authenticated access, with an attacker needing Contributor‑level or higher credentials to create or modify a post. Once the malicious script is stored, any visitor to the page will trigger its execution, making the impact visible to all users who load the page. This configuration does not require special network exposure and can be exploited from any location where the user can access the WordPress admin interface.