Based on the description, the vulnerability allows unauthenticated users to execute any shortcode that is registered on a WordPress site because the plugin does not correctly differentiate which shortcodes are present in user‑supplied content before stripping them. Attackers can embed malicious shortcode syntax into a search query, causing the plugin to process and execute it. The impact is arbitrary execution of code defined by the shortcode, which could lead to privilege escalation, data exfiltration, or further web application compromise.

Affected are installations of the WordPress All in One SEO plugin with versions earlier than 5.0.2.1. This includes the open‑source plugin distributed at All in One SEO. No other vendors are listed. If a site uses a custom fork or a different plugin name, the specific affected version should be checked against the version threshold.

Based on the description, the likely attack vector is an unauthenticated remote request to the search functionality, which is exposed to all visitors. The CVSS score of 6.5 indicates medium severity. The EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no public evidence of exploitation yet. If unauthenticated users can send a crafted search request, they could trigger arbitrary execution of registered shortcodes, potentially gaining full server access or deploying further payloads.