WordPress Plugin Vulnerabilities
All in One SEO < 4.9.7.1 - Contributor+ Sensitive Information Exposure via 'internalOptions' Localized Script Data
Description
The plugin is vulnerable to Sensitive Information Exposure via the `internalOptions` localized script data due to sensitive internal option data being passed to `wp_localize_script()` in post editor contexts without effective masking for low-privilege users. This makes it possible for authenticated attackers with Contributor-level access and above to view configured API/OAuth tokens and license-related values from the page source.
Affects Plugins
References
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
0x61626390
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-05-19 (about 4 months ago)
Added
2026-05-20 (about 4 months ago)
Last Updated
2026-05-20 (about 4 months ago)