If exploited, the flaw could allow authenticated users with contributor level access or higher to inject malicious scripts which are executed when a victim accesses the wp-admin panel's 'all posts' page.
After discovering this medium severity security issue, Wordfence reached out to the plugin's team and All In One SEO Pack received a patch to fix the issue just a few days later.
- These are the best WordPress plugins available today
- We've also put together a list of the best SEO tools
- These are the best SEO keyword research tools
Users of the plugin should update to the latest version of All In One SEO Pack (3.6.2) immediately to avoid falling victim to any potential attacks that try to exploit the now patched vulnerability.
All In One SEO Pack
As part of the plugin's functionality, it allows users with the ability to create or edit posts to set an SEO title and description directly from a post as they are working on it. This feature is available to all users with the ability to create posts such as contributors, authors and editors.
As the SEO title and SEO description for each post are displayed on the 'all posts' page, any values added to these fields would also be displayed there in an unsanitized format which would cause any saved scripts in these fields to be executed any time a user accessed this page.
In version 3.6.2 of All in One SEO Pack, the plugin's developer has added sanitization to all of the SEO post meta values so that any code injected into them would be unable to become executable scripts.
- We've also highlighted the best WordPress hosting
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.