CVE-2023-0586 in All in One SEO Pack Plugin
Summary
by MITRE • 02/24/2023
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The All in One SEO Pack plugin for WordPress represents one of the most widely used SEO solutions in the WordPress ecosystem, with over 10 million active installations. This vulnerability affects versions up to and including 4.2.9, making it a significant concern for WordPress administrators who rely on this plugin for their site optimization needs. The plugin's popularity and the nature of the vulnerability create a substantial risk landscape where malicious actors can exploit the weakness to compromise multiple websites simultaneously.
The technical flaw resides in the plugin's insufficient input sanitization and output escaping mechanisms across multiple parameters. This vulnerability is classified as a stored cross-site scripting flaw, meaning that malicious scripts are permanently stored on the server and executed whenever users access affected pages. The vulnerability specifically targets authenticated attackers who possess Contributor level privileges or higher, which is particularly concerning because contributors can often publish content and modify existing posts. This access level represents a significant threat vector since many WordPress sites have multiple contributors who may not be fully security-aware.
The operational impact of this vulnerability extends beyond simple script execution, as it creates a persistent threat that can be leveraged for various malicious activities. Attackers can inject malicious JavaScript code that can steal user session cookies, redirect visitors to phishing sites, or even perform actions on behalf of authenticated users. The stored nature of the vulnerability means that once a malicious script is injected, it will continue to execute whenever any user accesses the affected pages, potentially compromising numerous site visitors over time. This makes the vulnerability particularly dangerous in environments where content is frequently updated or where multiple contributors regularly access the site.
The vulnerability aligns with CWE-79 which specifically addresses Cross-Site Scripting flaws, and can be mapped to ATT&CK technique T1584.003 which covers the creation of malicious content through compromised accounts. Organizations should immediately update to version 4.3.0 or later to remediate this vulnerability, as the plugin developers have released patches addressing the input sanitization issues. Additionally, administrators should implement additional security measures including role-based access controls, regular security audits, and monitoring for unauthorized content modifications. The vulnerability also highlights the importance of input validation and output escaping as fundamental security practices in web application development, particularly for plugins that handle user input and modify site content.