smub All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your smub All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic version is affected

Latest smub All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic vulnerabilities

CVE-2026-19856 — All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query (CVSS 6.5)
CVE-2026-82884 — All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block (CVSS 6.8)
CVE-2026-10755 — All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration (CVSS 2.7)
CVE-2026-5075 — All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data (CVSS 4.3)
CVE-2025-14384 — All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure (CVSS 4.3)
CVE-2025-12847 — All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion (CVSS 4.3)
CVE-2025-2892 — All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL (CVSS 5.4)
CVE-2024-3368 — All in One SEO < 4.6.1.1 - Contributor+ Stored XSS (CVSS 6.1)
CVE-2024-3554 — All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
CVE-2023-0586 — All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2023-0585 — All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.8)
CVE-2022-42494 — WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.5)
CVE-2022-38093 — WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 8.8)
CVE-2021-25037 — All In One SEO < 4.1.5.3 - Authenticated SQL Injection (CVSS 6.5)
CVE-2021-25036 — All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation (CVSS 8.8)
CVE-2021-24307 — All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize (CVSS 8.8)