AI News/Wire summary
All in One SEO plugin has two flaws; update to version 5.0.2.1
Key points
- CVE-2026-100152 (rated 6.5) allows shortcode execution by unauthenticated attackers in versions up to 5.0.2, but only where breadcrumbs appear on search results pages.
- CVE-2026-85492 (rated 6.1) is a DOM-based XSS in versions up to 5.0.1.1, and needs a user with aioseo_manage_seo to open the SEO Preview panel.
- Version 5.0.2 patches the XSS flaw. Version 5.0.2.1 fixes the shortcode flaw, so it covers both issues.
Why it matters for marketers: Sites running AIOSEO with breadcrumbs or admin SEO users should update now, since the plugin's own AI and SEO tools touch content teams' workflows.
Summary by the Z Media news desk, from the outlets' reporting. Read the full stories at the source.
Read the original
Related on Z Media
- Google ships Gemini 4 Argon with tiered access and a price that doubles in NovemberOur brief, via Google DeepMind, 2 days ago
- OpenAI employee arrested over hidden recording device in officevia The Verge, 2 days ago
- YouTube Music starts labeling tracks made primarily with generative AIOur brief, via The Verge, yesterday
- Character.AI files for bankruptcy as Disney offers $20M for assets and a licenseOur brief, via TechCrunch, 3 days ago
- Anthropic warns small AI models could soon self-replicate across IoT devicesvia Ars Technica, 3 days ago
- Anthropic gives METR researchers employee-level access to its modelsvia TechCrunch, 5 hr ago