AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-02T15:17:44.553Z and has not been modified since then. The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor. This could allow users with the contributor role and above to perform Stored Cross-Site Scr [truncated]
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state. This issue was made public on July 20, 2026. The vulnerability allows unauthorized modifications to AI integration settings, potentially impacting site se [truncated]
