WordPress Plugin Vulnerabilities

All in One SEO < 4.9.7.1 - Contributor+ Sensitive Information Exposure via 'internalOptions' Localized Script Data

Description

The plugin is vulnerable to Sensitive Information Exposure via the `internalOptions` localized script data due to sensitive internal option data being passed to `wp_localize_script()` in post editor contexts without effective masking for low-privilege users. This makes it possible for authenticated attackers with Contributor-level access and above to view configured API/OAuth tokens and license-related values from the page source.

Affects Plugins

Fixed in 4.9.7.1

References

Classification

Type
SENSITIVE DATA DISCLOSURE
CWE
CVSS

Miscellaneous

Original Researcher
0x61626390
Verified
No

Timeline

Publicly Published
2026-05-19 (about 4 months ago)
Added
2026-05-20 (about 4 months ago)
Last Updated
2026-05-20 (about 4 months ago)

Other