VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

All-In-One Security (AIOS) – Security and Firewall security & vulnerabilities

all-in-one-wp-security-and-firewall— active installsLast vulnerability Oct 27, 2026

No known unpatched vulnerabilities in the latest version

All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
29Known vulnerabilities
  • Critical4
  • High4
  • Medium20
  • Low1
Vulnerabilities per year
2014: 1 vulnerability1142015: 5 vulnerabilities5152016: 5 vulnerabilities5162019: 1 vulnerability1192020: 2 vulnerabilities2202022: 6 vulnerabilities6222023: 4 vulnerabilities4232024: 2 vulnerabilities2242026: 3 vulnerabilities326

All All-In-One Security (AIOS) – Security and Firewall vulnerabilities

All-In-One Security (AIOS) – Security and Firewall vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Authenticated (Subscriber+) Two-Factor Authentication Bypass
≤5.4.0Update to 5.5.0
CVE-2026-111739
Medium6.3Authenticated (Subscriber+) Security Control Bypass
≤5.4.8Update to 5.4.9
CVE-2026-96825
High7.2Unauthenticated Stored Cross-Site Scripting via REST API Request Path
≤5.4.7Update to 5.4.8
CVE-2026-8438
Medium4.3Cross-Site Request Forgery to IP Blocking
≤5.2.6Update to 5.2.7
CVE-2024-30468
Medium6.1Reflected Cross-Site Scripting
≤5.2.5Update to 5.2.6
CVE-2024-1037
Medium5.3Protection Bypass of Renamed Login Page via URL Encoding
<5.2.5Update to 5.2.5
CVE-2023-52147
Medium5.9Plaintext Storage of Credentials
5.1.9 – 5.1.9Update to 5.2.0
—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤5.1.4Update to 5.1.5
CVE-2023-0157
Medium4.9Authenticated(Admin+) Directory Traversal
≤5.1.4Update to 5.1.5
CVE-2023-0156
Medium5.3Information Disclosure
≤5.1.2Update to 5.1.3
CVE-2022-4346
High8.8Cross-Site Request Forgery
≤5.1.0Update to 5.1.1
CVE-2022-44737
Medium6.5IP Spoofing to Protection Mechanism Bypass
≤5.0.7Update to 5.0.8
CVE-2022-4097
High8.8Cross-Site Request Forgery
≤5.1.0Update to 5.1.1
—
Medium6.55.0.7 - Protection Bypass via IP Spoofing
5.0.0 – 5.0.7Update to 5.0.8
—
Medium6.1Open Redirect and Reflected Cross-Site Scripting
<4.4.11Update to 4.4.11
CVE-2021-25102
Medium6.1Cross-Site Scripting
<4.4.6Update to 4.4.6
CVE-2020-29171
Medium4.7Reflected Cross-Site Scripting
≤4.4.3Update to 4.4.4
—
Critical9.8SQL Injection
<4.0.9Update to 4.0.9
CVE-2016-10887
Medium6.1Reflected Cross-Site Scripting
<4.2.0Update to 4.2.0
CVE-2016-10866
Medium5.3Captcha Bypass
≤4.1.2Update to 4.1.3
—
Critical9.8SQL Injection
<4.0.7Update to 4.0.7
CVE-2016-10888
Medium6.1Cross-Site Scripting
<4.0.6Update to 4.0.6
CVE-2016-10867
Medium6.1Cross-Site Scripting
<4.0.5Update to 4.0.5
CVE-2016-10868
Medium6.1Cross-Site Scripting
<3.9.8Update to 3.9.8
CVE-2015-9293
Medium6.1Reflected Cross-Site Scripting
<3.9.5Update to 3.9.5
CVE-2015-9294
Critical9.8SQL Injection
<3.9.1Update to 3.9.1
CVE-2015-9310
Low3.1Cross-Site Request Forgery
≤3.8.9Update to 3.9.0
CVE-2015-0895
Critical9.0SQL Injection
<3.8.8Update to 3.8.8
CVE-2015-0894
High7.4Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters
<3.8.3Update to 3.8.3
CVE-2014-6242

All-In-One Security (AIOS) – Security and Firewall: common questions

Does All-In-One Security (AIOS) – Security and Firewall have known vulnerabilities?

Yes. VulnCrest Radar lists 29 known vulnerabilities in All-In-One Security (AIOS) – Security and Firewall: 4 critical, 4 high, 20 medium, 1 low. None are known to affect version null.

How do I check which version of All-In-One Security (AIOS) – Security and Firewall I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent All-In-One Security (AIOS) – Security and Firewall vulnerability?

CVE-2026-111739, published Oct 27, 2026: Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) <= 5.4.0 - Authenticated (Subscriber+) Two-Factor Authentication Bypass. Severity: Medium (CVSS 4.3).

Is any All-In-One Security (AIOS) – Security and Firewall vulnerability listed in CISA KEV?

No. None of the known All-In-One Security (AIOS) – Security and Firewall vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?