Shortcode-Based Stored Cross-Site Scripting

An authenticated user with contributor‐level access can insert malicious JavaScript into a shortcode field. Because input isn’t fully sanitized, that script is saved and later executed in the browser of anyone viewing the affected page—typically an administrator—allowing the attacker to steal session data, perform actions on behalf of higher‐privileged users, or inject further malicious content. This represents a stored cross‐site scripting (XSS) risk that can lead to full site compromise if left unaddressed.

This vulnerability affects the following application versions:

• All in One SEO Pack 4.1.3.1
• All in One SEO Pack 4.1.3.3
• All in One SEO Pack 4.1.3.4
• All in One SEO Pack 4.1.4.1
• All in One SEO Pack 4.1.4.2
• All in One SEO Pack 4.1.4.3
• All in One SEO Pack 4.1.4.4
• All in One SEO Pack 4.1.4.5
• All in One SEO Pack 4.1.5.1
• All in One SEO Pack 4.1.5.2
• All in One SEO Pack 4.1.5.3
• All in One SEO Pack 4.1.6.2
• All in One SEO Pack 4.1.7
• All in One SEO Pack 4.1.8
• All in One SEO Pack 4.1.9.1
• All in One SEO Pack 4.1.9.3
• All in One SEO Pack 4.1.9.4
• All in One SEO Pack 4.1.10
• All in One SEO Pack 4.2.0
• All in One SEO Pack 4.2.1.1
• All in One SEO Pack 4.2.2
• All in One SEO Pack 4.2.3.1
• All in One SEO Pack 4.2.4
• All in One SEO Pack 4.2.5.1
• All in One SEO Pack 4.2.6
• All in One SEO Pack 4.2.6.1
• All in One SEO Pack 4.2.7.1
• All in One SEO Pack 4.2.8
• All in One SEO Pack 4.2.9
• All in One SEO Pack 4.3.0
• All in One SEO Pack 4.3.1
• All in One SEO Pack 4.3.1.1
• All in One SEO Pack 4.3.2
• All in One SEO Pack 4.3.3
• All in One SEO Pack 4.3.4.1
• All in One SEO Pack 4.3.5
• All in One SEO Pack 4.3.6.1
• All in One SEO Pack 4.3.7
• All in One SEO Pack 4.3.8
• All in One SEO Pack 4.3.9
• All in One SEO Pack 4.4.0.1
• All in One SEO Pack 4.4.1
• All in One SEO Pack 4.4.2
• All in One SEO Pack 4.4.3
• All in One SEO Pack 4.4.4
• All in One SEO Pack 4.4.5.1
• All in One SEO Pack 4.4.6
• All in One SEO Pack 4.4.7
• All in One SEO Pack 4.4.7.1
• All in One SEO Pack 4.4.8
• All in One SEO Pack 4.4.9.1
• All in One SEO Pack 4.4.9.2
• All in One SEO Pack 4.5.0
• All in One SEO Pack 4.5.1.1
• All in One SEO Pack 4.5.2.1
• All in One SEO Pack 4.5.3.1
• All in One SEO Pack 4.5.4
• All in One SEO Pack 4.5.5
• All in One SEO Pack 4.5.6
• All in One SEO Pack 4.5.7.1
• All in One SEO Pack 4.5.7.2
• All in One SEO Pack 4.5.7.3
• All in One SEO Pack 4.5.8
• All in One SEO Pack 4.5.9.1
• All in One SEO Pack 4.5.9.2
• All in One SEO Pack 4.6.0