All-In-One Security (AIOS) - Security and Firewall vulnerabilities

Known security issues in the All-In-One Security (AIOS) - Security and Firewall WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: all-in-one-wp-security-and-firewall
Latest version: 5.4.10
Active installs: 1,000,000+
Known vulnerabilities: 41
Data updated: 2026-10-17 09:32 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 5.4.9 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.4.9
Vulnerability	Severity	CVSS	Affected versions	Published
All-In-One Security (AIOS) – Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass CVE-2026-96825 · Source	Medium	4.2	< 5.4.9	2026-06-05

Fixed in version 5.4.8 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.4.8
Vulnerability	Severity	CVSS	Affected versions	Published
All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path CVE-2026-8438 · Source	High	7.2	< 5.4.8	2026-06-05

Fixed in version 5.2.7 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.2.7
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security <= 5.2.6 - Cross-Site Request Forgery to IP Blocking CVE-2024-30468 · Source	Medium	4.3	< 5.2.7	2024-02-08

Fixed in version 5.2.6 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.2.6
Vulnerability	Severity	CVSS	Affected versions	Published
All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting CVE-2024-1037 · Source	Medium	6.1	< 5.2.6	2024-02-06

Fixed in version 5.2.5 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.2.5
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security <= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding CVE-2023-52147 · Source	Low	3.7	< 5.2.5	2023-10-25

Fixed in version 5.2.0 (3)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.2.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Security & Firewall Plugin 5.1.9 is vulnerable to Sensitive Data Exposure No CVE assigned · Source	Not rated	-	< 5.2.0	2023-07-12
All In One WP Security 5.1.9 - Plaintext Storage of Credentials No CVE assigned · Source	Not rated	-	< 5.2.0	2023-07-11
All-In-One Security (AIOS) – Security and Firewall < 5.2.0 - Insecure Storage of Password No CVE assigned · Source	Not rated	-	< 5.2.0	-

Fixed in version 5.1.5 (3)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.1.5
Vulnerability	Severity	CVSS	Affected versions	Published
All-In-One Security (AIOS) <= 5.1.4 - Authenticated(Admin+) Directory Traversal CVE-2023-0156 · Source	Medium	4.9	< 5.1.5	2023-02-14
WordPress All In One WP Security & Firewall Plugin < 5.1.5 is vulnerable to Cross Site Scripting (XSS) CVE-2023-0157 · Source	Medium	4.8	< 5.1.5	2023-03-20
WordPress All In One WP Security & Firewall Plugin <= 5.1.4 is vulnerable to Directory Traversal No CVE assigned · Source	Not rated	-	< 5.1.5	2023-02-15

Fixed in version 5.1.3 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.1.3
Vulnerability	Severity	CVSS	Affected versions	Published
All-In-One Security <= 5.1.2 - Information Disclosure CVE-2022-4346 · Source	Medium	5.3	< 5.1.3	2022-12-09

Fixed in version 5.1.1 (2)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.1.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Security plugin <= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities CVE-2022-44737 · Source	Medium	6.5	< 5.1.1	2022-11-22
All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 5.1.1	2022-11-17

Fixed in version 5.0.8 (2)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 5.0.8
Vulnerability	Severity	CVSS	Affected versions	Published
All-In-One Security (AIOS) – Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass CVE-2022-4097 · Source	Medium	5.3	< 5.0.8	2022-11-21
All In One WP Security & Firewall 5.0.0 - 5.0.7 - Protection Bypass via IP Spoofing No CVE assigned · Source	Not rated	-	< 5.0.8	2022-09-30

Fixed in version 4.4.11 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.4.11
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Security plugin <= 4.4.10 - Authenticated Arbitrary Redirect / Reflected XSS vulnerability CVE-2021-25102 · Source	Medium	4.7	< 4.4.11	2022-04-11

Fixed in version 4.4.6 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.4.6
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Security & Firewall plugin <= 4.4.5 - Authenticated Cross-Site Scripting (XSS) vulnerability CVE-2020-29171 · Source	Medium	6.1	< 4.4.6	2020-12-24

Fixed in version 4.4.4 (3)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.4.4
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Security & Firewall plugin <= 4.4.3 - Reflected Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 4.4.4	2020-09-09
All In One WP Security & Firewall <= 4.4.3 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 4.4.4	2020-09-08
All In One WP Security & Firewall < 4.4.4 - CSRF & XSS No CVE assigned · Source	Not rated	-	< 4.4.4	-

Fixed in version 4.4.2 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.4.2
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security & Firewall <= 4.4.1 - Open Redirect & Hidden Login Page Exposure No CVE assigned · Source	Not rated	-	< 4.4.2	-

Fixed in version 4.2.2 (2)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.2.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Security & Firewall <= 4.2.1 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 4.2.2	2016-12-14
All In One WP Security & Firewall <= 4.2.1 - Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 4.2.2	-

Fixed in version 4.2.0 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.2.0
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security & Firewall 4.1.4-4.1.9 - Authenticated Cross-Site Scripting (XSS) CVE-2016-10866 · Source	Medium	6.1	< 4.2.0	2016-11-11

Fixed in version 4.1.3 (3)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.1.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Security & Firewall Plugin <= 4.1.2 - Multiple Vulnerabilities No CVE assigned · Source	Not rated	-	< 4.1.3	2016-07-31
All In One WP Security & Firewall <= 4.1.2 - Captcha Bypass No CVE assigned · Source	Not rated	-	< 4.1.3	2016-07-31
All In One WP Security & Firewall <= 4.1.2 - Multiple vulnerabilities in login CAPTCHA No CVE assigned · Source	Not rated	-	< 4.1.3	-

Fixed in version 4.0.9 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.0.9
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security And Firewall < 4.0.9 - Multiple SQL Injections CVE-2016-10887 · Source	Critical	9.8	< 4.0.9	2019-08-14

Fixed in version 4.0.7 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.0.7
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security And Firewall < 4.0.7 - Multiple SQL Injections CVE-2016-10888 · Source	Critical	9.8	< 4.0.7	2016-04-06

Fixed in version 4.0.6 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.0.6
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security And Firewall < 4.0.6 - XSS CVE-2016-10867 · Source	Medium	6.1	< 4.0.6	2016-02-23

Fixed in version 4.0.5 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 4.0.5
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security & Firewall <= 4.0.4 - Cross-Site Scripting CVE-2016-10868 · Source	Medium	6.1	< 4.0.5	2016-02-22

Fixed in version 3.9.8 (2)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 3.9.8
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security & Firewall <= 3.9.7 - Unauthenticated Cross-Site Scripting (XSS) CVE-2015-9293 · Source	Medium	6.1	< 3.9.8	2015-08-15
WordPress All In One WP Security & Firewall Plugin <= 3.9.7 - XSS No CVE assigned · Source	Not rated	-	< 3.9.8	2015-08-13

Fixed in version 3.9.5 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 3.9.5
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security And Firewall < 3.9.5 - XSS CVE-2015-9294 · Source	Medium	6.1	< 3.9.5	2015-04-20

Fixed in version 3.9.1 (2)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 3.9.1
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security & Firewall <= 3.9.0 - Blind SQL Injection CVE-2015-9310 · Source	Critical	9.8	< 3.9.1	2015-04-06
WordPress All In One WP Security & Firewall Plugin 3.9.0 - SQL Injection No CVE assigned · Source	Not rated	-	< 3.9.1	2015-04-08

Fixed in version 3.9.0 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 3.9.0
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security & Firewall vulnerable to cross-site request forgery CVE-2015-0895 · Source	Low	0.0	< 3.9.0	2015-01-08

Fixed in version 3.8.8 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 3.8.8
Vulnerability	Severity	CVSS	Affected versions	Published
All In One WP Security & Firewall vulnerable to SQL injection CVE-2015-0894 · Source	Low	0.0	< 3.8.8	2015-01-08

Fixed in version 3.8.4 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 3.8.4
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Firewall Plugin 3.8.3 - Persistent XSS No CVE assigned · Source	Not rated	-	< 3.8.4	2014-10-02

Fixed in version 3.8.3 (1)

All-In-One Security (AIOS) - Security and Firewall: Fixed in version 3.8.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All In One WP Security Plugin 3.8.2 - SQL Injection CVE-2014-6242 · Source	Low	0.0	< 3.8.3	2014-09-24

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.