WordPress plugin · all-in-one-seo-pack
Is All in One SEO safe?
Safe on 5.0.4 or newer.
The current version, 5.0.4, is past every affected range on record (21 of 21 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 21
- High or critical
- 2
- Exploited
- none
- Current version
- 5.0.4
- Last updated
- Oct 22, 2026
- Active installs
- 2,000,000+
Every recorded flaw
- Oct 3, 2026The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Arbitrary shortcode executionCVE-2026-100152 · affects up to 5.0.2 · reported by WordfenceMedium 6.5
- Oct 2, 2026All in One SEO: Does not correctly determineCVE-2026-19856 · fixed in 5.0.2.1 · reported by WPScanMedium 6.5
- Oct 2, 2026All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): DOM-Based Cross-Site ScriptingCVE-2026-85492 · affects up to 5.0.1.1 · reported by WordfenceMedium 6.1
- Sep 2, 2026All in One SEO: Does not sanitise and escape some content stored in posts before rendering it back in the post editorCVE-2026-82884 · fixed in 5.0.0.1 · reported by WPScanMedium 6.8
- Jul 20, 2026All in One SEO: Does not correctly restrict access to some of its AI integration REST API endpointsCVE-2026-10755 · fixed in 4.9.9 · reported by WPScanLow 2.7
- May 20, 2026All in One SEO: Sensitive Information ExposureCVE-2026-5075 · affects up to 4.9.7 · reported by WordfenceMedium 4.3
- Jan 16, 2026All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic: Unauthorized access of dataCVE-2025-14384 · affects up to 4.9.2 · reported by WordfenceMedium 4.3
- Dec 18, 2025All In One SEO Pack: Insertion of Sensitive Information Into Sent DataCVE-2025-64295 · affects up to 4.8.6.1 · reported by PatchstackMedium 6.5
- Dec 16, 2025All In One SEO Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67950 · affects up to 4.9.1 · reported by PatchstackHigh 8.5
- Nov 15, 2025All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic: Unauthorized arbitrary media attachment deletionCVE-2025-12847 · affects up to 4.8.9 · reported by WordfenceMedium 4.3
- Sep 22, 2025All In One SEO Pack: Missing AuthorizationCVE-2025-58650 · affects up to 4.8.7.1 · reported by PatchstackMedium 5.4
- Sep 22, 2025All In One SEO Pack: Insertion of Sensitive Information Into Sent DataCVE-2025-58649 · affects up to 4.8.7.1 · reported by PatchstackMedium 4.3
- May 19, 2025All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic: Stored Cross-Site ScriptingCVE-2025-2892 · affects up to 4.8.1.1 · reported by WordfenceMedium 6.4
- May 20, 2024All in One SEO: Does not validate and escape some of its Post fields before outputting them backCVE-2024-3368 · fixed in 4.6.1.1 · reported by WPScanMedium 6.1
- May 2, 2024All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic: Stored Cross-Site ScriptingCVE-2024-3554 · affects up to 4.6.0 · reported by WordfenceMedium 6.4
- Feb 24, 2023All in One SEO Pack: Stored Cross-Site ScriptingCVE-2023-0586 · affects up to 4.2.9 · reported by Wordfence2.5% oddsMedium 6.4
- Feb 24, 2023All in One SEO Pack: Stored Cross-Site ScriptingCVE-2023-0585 · affects up to 4.2.9 · reported by WordfenceMedium 4.4
- Sep 9, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.CVE-2022-38093 · affects up to 4.2.3.1 · reported by PatchstackMedium 5.4
- Jan 17, 2022All in One SEO: Is affected by an authenticated SQL injection issueCVE-2021-25037 · fixed in 4.1.5.3 · reported by WPScan1.3% oddsMedium 6.5
- Jan 17, 2022All in One SEO: Is affected by a Privilege Escalation issueCVE-2021-25036 · fixed in 4.1.5.3 · reported by WPScan3.0% oddsHigh 8.8
- Oct 16, 2019The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific deCVE-2019-16520 · fixed in 3.2.7 · reported by MITRE1.5% oddsMedium 5.4
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.