Plugin icon

All-In-One Security (AIOS) – Security and Firewall

all-in-one-wp-security-and-firewall

Vulnerabilities:

26

Last Updated:

November 12, 2025

Active Installs:

1000000

Published
Title
Fixed in
CVSS
Published
2024-02-08
Title
All In One WP Security < 5.2.7 - Cross-Site Request Forgery to IP Blocking
Fixed in
Fixed in 5.2.7
CVSS
4.3 (medium)
Published
2024-02-06
Title
All-In-One Security (AIOS) – Security and Firewall < 5.2.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.2.6
CVSS
6.1 (medium)
Published
2023-10-25
Title
All In One WP Security < 5.2.5 - Protection Bypass of Renamed Login Page via URL Encoding
Fixed in
Fixed in 5.2.5
CVSS
5.3 (medium)
Published
2023-07-14
Title
All-In-One Security (AIOS) – Security and Firewall < 5.2.0 - Insecure Storage of Password
Fixed in
Fixed in 5.2.0
CVSS
4.5 (medium)
Published
2023-03-20
Title
All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal
Fixed in
Fixed in 5.1.5
CVSS
6.8 (medium)
Published
2023-03-20
Title
All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS
Fixed in
Fixed in 5.1.5
CVSS
3.4 (low)
Published
2022-12-27
Title
All In One WP Security & Firewall < 5.1.3 - Configuration Leak
Fixed in
Fixed in 5.1.3
CVSS
5.3 (medium)
Published
2022-11-22
Title
All-In-One Security < 5.1.1 - Bulk Actions via CSRF
Fixed in
Fixed in 5.1.1
CVSS
4.3 (medium)
Published
2022-11-21
Title
All In One WP Security & Firewall < 5.0.8 - IP Spoofing
Fixed in
Fixed in 5.0.8
CVSS
5.3 (medium)
Published
2022-04-11
Title
All In One WP Security < 4.4.11 - Authenticated Arbitrary Redirect / Reflected XSS
Fixed in
Fixed in 4.4.11
CVSS
3.4 (low)
Published
2021-02-10
Title
All In One WP Security & Firewall < 4.4.6 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.4.6
CVSS
6.6 (medium)
Published
2020-09-09
Title
All In One WP Security & Firewall < 4.4.4 - CSRF & XSS
Fixed in
Fixed in 4.4.4
CVSS
3.5 (low)
Published
2019-10-08
Title
All In One WP Security & Firewall <= 4.4.1 - Open Redirect & Hidden Login Page Exposure
Fixed in
Fixed in 4.4.2
CVSS
n/a
Published
2016-12-14
Title
All In One WP Security & Firewall <= 4.2.1 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.2.2
CVSS
n/a
Published
2016-11-16
Title
All In One WP Security & Firewall 4.1.4-4.1.9 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.2.0
CVSS
6.1 (medium)
Published
2016-07-31
Title
All In One WP Security & Firewall <= 4.1.2 - Multiple vulnerabilities in login CAPTCHA
Fixed in
Fixed in 4.1.3
CVSS
n/a
Published
2016-05-10
Title
All In One WP Security And Firewall < 4.0.9 - Multiple SQL Injections
Fixed in
Fixed in 4.0.9
CVSS
9.8 (critical)
Published
2016-04-06
Title
All In One WP Security And Firewall < 4.0.7 - Multiple SQL Injections
Fixed in
Fixed in 4.0.7
CVSS
9.8 (critical)
Published
2016-02-23
Title
All In One WP Security And Firewall < 4.0.6 - XSS
Fixed in
Fixed in 4.0.6
CVSS
6.1 (medium)
Published
2016-02-22
Title
All In One WP Security And Firewall < 4.0.5 - XSS
Fixed in
Fixed in 4.0.5
CVSS
6.1 (medium)
Published
2015-08-13
Title
All In One WP Security & Firewall <= 3.9.7 - Unauthenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.9.8
CVSS
6.1 (medium)
Published
2015-04-21
Title
All In One WP Security And Firewall < 3.9.5 - XSS
Fixed in
Fixed in 3.9.5
CVSS
6.1 (medium)
Published
2015-04-07
Title
All In One WP Security & Firewall <= 3.9.0 - Blind SQL Injection
Fixed in
Fixed in 3.9.1
CVSS
9.8 (critical)
Published
2015-03-09
Title
All In One WP Security & Firewall <= 3.8.7 - SQL Injection
Fixed in
Fixed in 3.8.8
CVSS
n/a
Published
2015-03-06
Title
All In One WP Security & Firewall < 3.9.0 - CSRF
Fixed in
Fixed in 3.9.0
CVSS
n/a
Published
2014-09-26
Title
All In One WP Security plugin 3.8.2 - 2xSQL Injections
Fixed in
Fixed in 3.8.3
CVSS
n/a