All-In-One Security (AIOS) – Security and Firewall
all-in-one-wp-security-and-firewall · plugin
Known security vulnerabilities for All-In-One Security (AIOS) – Security and Firewall. Find out in seconds which version runs on your site with WP Lens.
18 known vulnerabilities
3 critical · 14 exploitable without logging in · 1 with public exploit code · latest Sep 30, 2026
Listed on wordpress.org · latest 5.4.10 · last updated Sep 17, 2026 · 1M+ installs
wordpress.org status checked on Oct 6, 2026
Vulnerabilities
- Critical 9.8
CVE-2016-10888unauthenticated
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
- Critical 9.8
CVE-2016-10887unauthenticated
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
- Critical 9.8
CVE-2015-9310unauthenticated
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
- High 8.8
CVE-2022-44737unauthenticated≤ 5.1.0
WordPress All In One WP Security plugin <= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
- High 7.2
CVE-2026-8438unauthenticated≤ 5.4.7
All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path
- Medium 6.8
Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote att
- Medium 6.5
CVE-2014-6242login required
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated
- Medium 6.1
CVE-2024-1037unauthenticated · needs a click≤ 5.2.5
All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting
- Medium 6.1
CVE-2020-29171unauthenticated · needs a click
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall
- Medium 6.1
CVE-2016-10867unauthenticated · needs a click
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
- Medium 6.1
CVE-2016-10866unauthenticated · needs a click
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
- Medium 6.1
CVE-2016-10868unauthenticated · needs a click
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection s
- Medium 6.1
CVE-2015-9294unauthenticated · needs a click
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
- Medium 6.1
CVE-2015-9293unauthenticated · needs a click
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
- Medium 6.0
SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute ar
- Medium 4.3
CVE-2024-30468unauthenticated · needs a click≤ 5.2.6
WordPress All-In-One Security (AIOS) – Security and Firewall plugin <= 5.2.6 - Cross Site Request Forgery (CSRF) vulnerability
- Medium 4.2
CVE-2026-96825login required≤ 5.4.8
WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability
- Low 3.7
CVE-2023-52147unauthenticated≤ 5.2.4
WordPress All-In-One Security (AIOS) plugin <= 5.2.4 - Secret Login Page Location Disclosure on Multisites vulnerability
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).