VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) security & vulnerabilities

all-in-one-seo-pack— active installsLast vulnerability Oct 30, 2026

No known unpatched vulnerabilities in the latest version

All 33 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
33Known vulnerabilities
  • Critical1
  • High5
  • Medium27
  • Low0
Vulnerabilities per year
2014: 4 vulnerabilities4142015: 2 vulnerabilities2152016: 2 vulnerabilities2162018: 1 vulnerability1182019: 1 vulnerability1192020: 1 vulnerability1202021: 3 vulnerabilities3212022: 1 vulnerability1222023: 2 vulnerabilities2232024: 2 vulnerabilities2242025: 6 vulnerabilities6252026: 8 vulnerabilities826

All All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) vulnerabilities

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter
≤5.0.3Update to 5.0.4
CVE-2026-109367
Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
≤5.0.2Update to 5.0.2.1
CVE-2026-100152
Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤5.0.2.0Update to 5.0.2.1
CVE-2026-19856
Medium6.1Reflected DOM-Based Cross-Site Scripting via URL Pathname
≤5.0.1.1Update to 5.0.2
CVE-2026-85492
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.0.0.0Update to 5.0.0.1
CVE-2026-82884
Medium5.3Missing Authorization
<4.9.9Update to 4.9.9
CVE-2026-10755
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
≤4.9.7Update to 4.9.7.1
CVE-2026-5075
Medium4.3Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure
≤4.9.2Update to 4.9.3
CVE-2025-14384
Medium6.5Authenticated (Contributor+) SQL Injection
≤4.9.1Update to 4.9.1.1
CVE-2025-67950
Medium4.3Authenticated (Subscriber+) Information Exposure
≤4.8.6.1Update to 4.8.7
CVE-2025-64295
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion
≤4.8.9Update to 4.9.0
CVE-2025-12847
Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
≤4.8.7.1Update to 4.8.7.2
CVE-2025-58649
Medium5.4Missing Authorization
≤4.8.7.1Update to 4.8.7.2
CVE-2025-58650
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL
≤4.8.1.1Update to 4.8.2
CVE-2025-2892
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.6.0Update to 4.6.1.1
CVE-2024-3554
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.6.0Update to 4.6.1.1
CVE-2024-3368
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.2.9Update to 4.3.0
CVE-2023-0586
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.2.9Update to 4.3.0
CVE-2023-0585
High8.8Cross-Site Request Forgery
≤4.2.3.1Update to 4.2.4
CVE-2022-38093
High8.84.1.5.2 Authorization Bypass
4.0.0 – 4.1.5.2Update to 4.1.5.3
CVE-2021-25036
Critical9.64.1.5.2 - Authenticated SQL Injection
4.1.3.1 – 4.1.5.2Update to 4.1.5.3
CVE-2021-25037
High8.8Authenticated Code Injection
<4.1.0.2Update to 4.1.0.2
CVE-2021-24307
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<3.6.2Update to 3.6.2
CVE-2020-35946
Medium6.4Stored Cross-Site Scripting
≤3.2.6Update to 3.2.7
CVE-2019-16520
Medium6.4Authenticated Stored Cross-Site Scripting
<2.10Update to 2.10
—
High7.2Unauthenticated Stored Cross-Site Scripting
<2.3.8Update to 2.3.8
—
High7.2Stored Cross-Site Scripting
<2.3.7Update to 2.3.7
—
Medium6.1Reflected Cross-Site Scripting
<2.2.6.2Update to 2.2.6.2
—
Medium5.3Information Disclosure
<2.2.6Update to 2.2.6
CVE-2015-0902
Medium6.1Cross-Site Scripting via Search Parameter
≤2.0.3Update to 2.0.3.1
CVE-2013-5988
Medium6.3Missing Authorization
≤2.1.5Update to 2.1.6
—
Medium6.4Cross-Site Scripting
≤2.1.5Update to 2.1.6
—
Medium4.3Privilege Escalation to Arbitrary Post Modification
≤2.2.4.1Update to 2.2.5
—

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): common questions

Does All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) have known vulnerabilities?

Yes. VulnCrest Radar lists 33 known vulnerabilities in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): 1 critical, 5 high, 27 medium. None are known to affect version null.

How do I check which version of All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) vulnerability?

CVE-2026-109367, published Oct 30, 2026: All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter. Severity: Medium (CVSS 5.3).

Is any All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) vulnerability listed in CISA KEV?

No. None of the known All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?