The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input… (CVE-2026-19856)
The All in One SEO WordPress plugin versions before 5.0.2.1 have a vulnerability where the plugin does not properly identify shortcodes in user-derived content before stripping them. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on the site. Additionally, on sites upgraded from older versions, the protection mechanism is completely disabled, making exploitation easier without needing crafted input.
AI Analysis
Technical Summary
CVE-2026-19856 affects the All in One SEO WordPress plugin prior to version 5.0.2.1. The vulnerability arises because the plugin fails to correctly determine which shortcodes are present in content derived from user input before deciding which shortcodes to strip. This improper handling enables unauthenticated attackers to execute arbitrary shortcodes registered on the WordPress site. Furthermore, sites upgraded from older versions have the protection disabled outright, increasing the risk of exploitation without requiring specially crafted input.
Potential Impact
An unauthenticated attacker can execute arbitrary shortcodes on the affected WordPress site, potentially leading to information disclosure and integrity impact as indicated by the CVSS vector (Confidentiality and Integrity impact). There is no reported impact on availability. The vulnerability could allow attackers to perform actions or access data that should be restricted.
Mitigation Recommendations
The vulnerability is fixed in version 5.0.2.1 of the All in One SEO WordPress plugin. Users should upgrade to version 5.0.2.1 or later to remediate this issue. No other mitigation guidance is provided. Patch status is confirmed by the version number in the description.
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input… (CVE-2026-19856)
Description
The All in One SEO WordPress plugin versions before 5.0.2.1 have a vulnerability where the plugin does not properly identify shortcodes in user-derived content before stripping them. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on the site. Additionally, on sites upgraded from older versions, the protection mechanism is completely disabled, making exploitation easier without needing crafted input.
CVSS v3.1
Score 6.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19856 affects the All in One SEO WordPress plugin prior to version 5.0.2.1. The vulnerability arises because the plugin fails to correctly determine which shortcodes are present in content derived from user input before deciding which shortcodes to strip. This improper handling enables unauthenticated attackers to execute arbitrary shortcodes registered on the WordPress site. Furthermore, sites upgraded from older versions have the protection disabled outright, increasing the risk of exploitation without requiring specially crafted input.
Potential Impact
An unauthenticated attacker can execute arbitrary shortcodes on the affected WordPress site, potentially leading to information disclosure and integrity impact as indicated by the CVSS vector (Confidentiality and Integrity impact). There is no reported impact on availability. The vulnerability could allow attackers to perform actions or access data that should be restricted.
Mitigation Recommendations
The vulnerability is fixed in version 5.0.2.1 of the All in One SEO WordPress plugin. Users should upgrade to version 5.0.2.1 or later to remediate this issue. No other mitigation guidance is provided. Patch status is confirmed by the version number in the description.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f9q5-f8p2-3w5w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19856"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac139bba43b0b3b89d69d48
Added to database: 10/03/2026, 17:22:03 UTC
Last enriched: 10/03/2026, 17:43:02 UTC
Last updated: 10/04/2026, 03:45:56 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.