CVE-2026-19856CWE-74

CVE-2026-19856

Medium · published October 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-10-02T23:16Z
References (1)
https://wpscan.com/vulnerability/e35365d3-65de-45a7-9629-17aacd5299c7/ · [email protected]
EPSS history
Timeline
  • 04 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 02 OCT 18:25Z
    All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query
    cvelistv5