WordPress plugin · all-in-one-wp-security-and-firewall
Is All-In-One Security (AIOS) safe?
Safe on 5.5.0 or newer.
The current version, 5.5.0, is past every affected range on record (23 of 23 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 23
- High or critical
- 4
- Exploited
- none
- Current version
- 5.5.0
- Last updated
- Oct 26, 2026
- Active installs
- 1,000,000+
Every recorded flaw
- Sep 30, 2026Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.CVE-2026-96825 · affects up to 5.4.8 · reported by PatchstackMedium 4.2
- Jun 5, 2026All-In-One Security (AIOS) – Security and Firewall: Stored Cross-Site ScriptingCVE-2026-8438 · affects up to 5.4.7 · reported by Wordfence9.9% oddsHigh 7.2
- Jun 4, 2024All In One WP Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52147 · affects up to 5.2.4 · reported by PatchstackLow 3.7
- Mar 29, 2024All In One WP Security & Firewall: Cross-Site Request Forgery (CSRF)CVE-2024-30468 · affects up to 5.2.6 · reported by PatchstackMedium 4.3
- Feb 7, 2024All-In-One Security (AIOS) – Security and Firewall: Reflected Cross-Site ScriptingCVE-2024-1037 · affects up to 5.2.5 · reported by WordfenceMedium 6.1
- Apr 10, 2023All-In-One Security (AIOS): Does not escape the content of log files before outputting it to the plugin admin pageCVE-2023-0157 · fixed in 5.1.5 · reported by WPScan32% oddsMedium 4.8
- Apr 10, 2023All-In-One Security (AIOS): Does not limit what log files to display in it's settings pagesCVE-2023-0156 · fixed in 5.1.5 · reported by WPScan20% oddsMedium 4.9
- Jan 23, 2023All-In-One Security (AIOS): Leaked settings of the plugin publiclyCVE-2022-4346 · fixed in 5.1.3 · reported by WPScanMedium 5.3
- Dec 12, 2022All-In-One Security (AIOS): Is susceptible to IP Spoofing attacksCVE-2022-4097 · fixed in 5.0.8 · reported by WPScanMedium 5.3
- Nov 22, 2022Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.CVE-2022-44737 · affects up to 5.1.0 · reported by PatchstackMedium 6.5
- May 2, 2022All In One WP Security & Firewall: Does not validateCVE-2021-25102 · fixed in 4.4.11 · reported by WPScanMedium 4.7
- Feb 10, 2021Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-secuCVE-2020-29171 · fixed in 4.4.6 · reported by MITRE1.5% oddsMedium 6.1
- Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.CVE-2016-10888 · fixed in 4.0.7 · reported by MITRE1.9% oddsCritical 9.8
- Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.CVE-2016-10887 · fixed in 4.0.9 · reported by MITRE1.9% oddsCritical 9.8
- Aug 14, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.CVE-2015-9310 · fixed in 3.9.1 · reported by MITRE1.9% oddsCritical 9.8
- Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.CVE-2016-10867 · fixed in 4.0.6 · reported by MITREMedium 6.1
- Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.CVE-2016-10866 · fixed in 4.2.0 · reported by MITREMedium 6.1
- Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.CVE-2016-10868 · fixed in 4.0.5 · reported by MITREMedium 6.1
- Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.CVE-2015-9294 · fixed in 3.9.5 · reported by MITREMedium 6.1
- Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.CVE-2015-9293 · fixed in 3.9.8 · reported by MITREMedium 6.1
- Mar 6, 2015Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack theCVE-2015-0895 · fixed in 3.9.0 · reported by vultures@jpcert.or.jp1.1% oddsMedium 6.8
- Mar 6, 2015SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commandsCVE-2015-0894 · fixed in 3.8.8 · reported by vultures@jpcert.or.jp1.5% oddsMedium 6
- Oct 2, 2014Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arCVE-2014-6242 · fixed in 3.8.3 · reported by MITRE4.2% oddsMedium 6.5
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.