---
id: CVE-2026-109367
title: >-
  All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in
  's' Search Query Parameter
summary: >-
  The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema,
  Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to
  Sensitive Information Exposure in all versions up to, and including, 5.0.3 via
  the 's' p…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: smub
product: >-
  All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local
  SEO, Sitemap & SEO Insights)
affected:
  - >-
    all_in_one_seo_ai_seo_plugin_to_boost_seo_rankings_traffic_schema_local_seo_sitemap_seo_insights
    <= 5.0.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T17:12:48.672777Z'
published: '2026-10-31'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:54:24.960Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109367'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/75510022-382c-4d03-9c59-1d06349e72bb?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1494
  - url: >-
      https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1393
  - url: >-
      https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L965
  - url: >-
      https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1214
  - url: >-
      https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Meta/Title.php#L116
  - url: >-
      https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Meta/Helpers.php#L95
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3760115/all-in-one-seo-pack/trunk/app/Common/Utils/Tags.php
tags:
  - cve.org
epss: 0.0028
epssPercentile: 0.20569
ingestedAt: '2026-11-05T19:30:42.754Z'
---

## Overview

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers to extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema.

## Affected

- `all_in_one_seo_ai_seo_plugin_to_boost_seo_rankings_traffic_schema_local_seo_sitemap_seo_insights <= 5.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.