{"id":"CVE-2026-82884","state":"PUBLISHED","title":"All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block","description":"The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privileged user edits the post.","publishedAt":"2026-09-02T14:16:53.430Z","updatedAt":"2026-09-02T14:57:36.980Z","severity":{"score":6.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"WPScan"},"assigner":"WPScan","products":["Unknown All in One SEO"],"affected":[{"vendor":"Unknown","product":"All in One SEO","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.0.0.1","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/9d4e5075-062a-42d7-beba-9f96f9ce76da/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82884.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82884","state":"PUBLISHED","datePublished":"2026-09-02T14:16:53.430Z","dateUpdated":"2026-09-02T14:57:36.980Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-08-31T08:49:38.647Z"},"containers":{"cna":{"title":"All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block","descriptions":[{"lang":"en","value":"The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privileged user edits the post."}],"affected":[{"vendor":"Unknown","product":"All in One SEO","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.0.0.1","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/9d4e5075-062a-42d7-beba-9f96f9ce76da/","tags":["exploit","vdb-entry","technical-description"]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-09-02T14:16:53.430Z"},"credits":[{"lang":"en","value":"Asaf Mozes","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82884","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-02T14:46:30.091406Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","type":"CWE","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-02T14:57:36.980Z"}}]}}}