CVE-2025-2892mediumCWE-79

CVE-2025-2892: medium-severity vulnerability in smub All in One SEO – Powerful SEO Plugin to…

All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL

Published · Updated

Follow this CVE+ Monitor All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.3%
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
smub · All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
Related CVEs — smub All in One SEO – Powerful SEO Plugin to…

In the same product, most dangerous first.

CVE-2023-0586MEDIUMAll in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 2.5%CVE-2023-0585MEDIUMAll in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2024-3554MEDIUMAll in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-5075MEDIUMAll in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script DataEPSS 0.3%CVE-2025-12847MEDIUMAll in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media DeletionEPSS 0.3%CVE-2025-14384MEDIUMAll in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit DisclosureEPSS 0.2%