CVE-2019-16520

The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.

• CWE-79

• http://www.openwall.com/lists/oss-security/2019/10/16/5Exploit, Mailing List, Third Party Advisory
• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-04_WordPress_Plugin_All_in_One_SEO_PackExploit, Third Party Advisory
• https://github.com/semperfiwebdesign/all-in-one-seo-pack/issues/2888Patch, Third Party Advisory
• https://semperplugins.com/all-in-one-seo-pack-changelog/Release Notes, Vendor Advisory
• https://wordpress.org/plugins/all-in-one-seo-pack/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9915Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/10/16/5Exploit, Mailing List, Third Party Advisory
• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-04_WordPress_Plugin_All_in_One_SEO_PackExploit, Third Party Advisory
• https://github.com/semperfiwebdesign/all-in-one-seo-pack/issues/2888Patch, Third Party Advisory
• https://semperplugins.com/all-in-one-seo-pack-changelog/Release Notes, Vendor Advisory
• https://wordpress.org/plugins/all-in-one-seo-pack/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9915Third Party Advisory

Published

Oct 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16515An issue was discovered in ConnectWise Control (formerly kno…6.5
• CVE-2019-16516An issue was discovered in ConnectWise Control (formerly kno…5.3
• CVE-2019-16517An issue was discovered in ConnectWise Control (formerly kno…9.8
• CVE-2019-16518An issue was discovered on Swell Kit Mod devices that use th…4.3
• CVE-2019-16519ESET Cyber Security 6.7.900.0 for macOS allows a local attac…7.8
• CVE-2019-1652A vulnerability in the web-based management interface of Cis…7.2
• CVE-2019-16521The broken-link-checker plugin through 1.11.8 for WordPress …6.1
• CVE-2019-16522The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU…4.8
• CVE-2019-16523The events-manager plugin through 5.9.5 for WordPress (aka E…5.4
• CVE-2019-16524The easy-fancybox plugin before 1.8.18 for WordPress (aka Ea…4.8
• CVE-2019-16525An XSS issue was discovered in the checklist plugin before 1…6.1
• CVE-2019-16528An issue was discovered in the AbuseFilter extension for Med…7.5