Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · all-in-one-wp-security-and-firewall
All-In-One Security (AIOS)
23 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 30, 2026Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.CVE-2026-96825 · affects up to 5.4.8 · reported by PatchstackMedium 4.2
Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
Jun 5, 2026All-In-One Security (AIOS) – Security and Firewall: Stored Cross-Site ScriptingCVE-2026-8438 · affects up to 5.4.7 · reported by WordfenceHigh 7.2
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administra
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 4, 2024All In One WP Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52147 · affects up to 5.2.4 · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4.
Mar 29, 2024All In One WP Security & Firewall: Cross-Site Request Forgery (CSRF)CVE-2024-30468 · affects up to 5.2.6 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6.
Feb 7, 2024All-In-One Security (AIOS) – Security and Firewall: Reflected Cross-Site ScriptingCVE-2024-1037 · affects up to 5.2.5 · reported by WordfenceMedium 6.1
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 10, 2023All-In-One Security (AIOS): Does not escape the content of log files before outputting it to the plugin admin pageCVE-2023-0157 · fixed in 5.1.5 · reported by WPScanMedium 4.8
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
Apr 10, 2023All-In-One Security (AIOS): Does not limit what log files to display in it's settings pagesCVE-2023-0156 · fixed in 5.1.5 · reported by WPScanMedium 4.9
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
Jan 23, 2023All-In-One Security (AIOS): Leaked settings of the plugin publiclyCVE-2022-4346 · fixed in 5.1.3 · reported by WPScanMedium 5.3
The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.
Dec 12, 2022All-In-One Security (AIOS): Is susceptible to IP Spoofing attacksCVE-2022-4097 · fixed in 5.0.8 · reported by WPScanMedium 5.3
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).
Nov 22, 2022Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.CVE-2022-44737 · affects up to 5.1.0 · reported by PatchstackMedium 6.5
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.
May 2, 2022All In One WP Security & Firewall: Does not validateCVE-2021-25102 · fixed in 4.4.11 · reported by WPScanMedium 4.7
The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk
Feb 10, 2021Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-secuCVE-2020-29171 · fixed in 4.4.6 · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.CVE-2016-10888 · fixed in 4.0.7 · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.CVE-2016-10887 · fixed in 4.0.9 · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.CVE-2015-9310 · fixed in 3.9.1 · reported by MITRECritical 9.8
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.CVE-2016-10867 · fixed in 4.0.6 · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.CVE-2016-10866 · fixed in 4.2.0 · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.CVE-2016-10868 · fixed in 4.0.5 · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.CVE-2015-9294 · fixed in 3.9.5 · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.CVE-2015-9293 · fixed in 3.9.8 · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Mar 6, 2015Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack theCVE-2015-0895 · fixed in 3.9.0 · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
Mar 6, 2015SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commandsCVE-2015-0894 · fixed in 3.8.8 · reported by vultures@jpcert.or.jpMedium 6
SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Oct 2, 2014Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arCVE-2014-6242 · fixed in 3.8.3 · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.