All in One SEO < 5.0.2 - Reflected DOM-Based XSS via URL Pathname

Description

The plugin is vulnerable to DOM-Based Cross-Site Scripting via the URL pathname due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname.