CVE-2026-82884: CWE-79 Cross-Site Scripting (XSS) in All in One SEO

CVE-2026-82884 is a stored XSS vulnerability in the All in One SEO WordPress plugin prior to version 5.0.0.1. The vulnerability arises because the plugin fails to sanitize and escape some post content before displaying it in the post editor interface. This enables users with contributor-level privileges or above to embed malicious scripts that execute when a user with higher privileges opens the post editor, potentially compromising confidentiality, integrity, and availability of the affected system.

Successful exploitation can lead to execution of arbitrary scripts in the context of a higher privileged user, resulting in potential data theft, privilege escalation, or disruption of service. The CVSS 3.1 base score is 6.8 (medium severity), reflecting network attack vector, low attack complexity, required privileges at the high level, and user interaction needed. Confidentiality, integrity, and availability impacts are all rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level user permissions and avoid editing posts from less trusted users. Monitor vendor channels for updates and apply patches promptly once released.