Plugin security history

All-In-One Security (AIOS) – Security and Firewall Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 27 vulnerability records associated with All-In-One Security (AIOS) – Security and Firewall, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

27Total records

4Critical

4High

18Medium

1Low

0Informational

27Patched records

0Currently marked unpatched

2014-09-24First disclosure

2026-06-05Latest disclosure

22 of 27CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	1	1 records
2015	5	5 records
2016	5	5 records
2019	1	1 records
2020	2	2 records
2022	6	6 records
2023	4	4 records
2024	2	2 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
Critical	4	14.8%
High	4	14.8%
Medium	18	66.7%
Low	1	3.7%

Vulnerability-Type Breakdown

Cross-Site Scripting

11 records40.7%

First: 2015. Latest: 2026.

SQL Injection

5 records18.5%

First: 2014. Latest: 2019.

Other

5 records18.5%

First: 2016. Latest: 2023.

CSRF

4 records14.8%

First: 2015. Latest: 2024.

Information Disclosure

1 record3.7%

First: 2022. Latest: 2022.

Path Traversal

1 record3.7%

First: 2023. Latest: 2023.

Patch Status

Patched: 27
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.4.8
5.2.7
5.2.6
5.2.5
5.2.0
5.1.5
5.1.3
5.1.1
5.0.8
4.4.11
4.4.6
4.4.4
4.0.9
4.2.0
4.1.3
4.0.7
4.0.6
4.0.5
3.9.8
3.9.5
3.9.1
3.8.8
3.9.0
3.8.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.4.7`	All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path	June 5, 2026	5.4.8	High
`*-5.2.6`	All In One WP Security <= 5.2.6 - Cross-Site Request Forgery to IP Blocking	February 8, 2024	5.2.7	Medium
`*-5.2.5`	All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting	February 6, 2024	5.2.6	Medium
`[*, 5.2.5)`	All In One WP Security <= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding	October 25, 2023	5.2.5	Medium
`5.1.9`	All In One WP Security 5.1.9 - Plaintext Storage of Credentials	July 11, 2023	5.2.0	Medium
`*-5.1.4`	All-In-One Security (AIOS) <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting	March 20, 2023	5.1.5	Medium
`*-5.1.4`	All-In-One Security (AIOS) <= 5.1.4 - Authenticated(Admin+) Directory Traversal	February 14, 2023	5.1.5	Medium
`*-5.1.2`	All-In-One Security <= 5.1.2 - Information Disclosure	December 9, 2022	5.1.3	Medium
`*-5.1.0`	All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery	November 22, 2022	5.1.1	High
`*-5.0.7`	All-In-One Security (AIOS) – Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass	November 21, 2022	5.0.8	Medium
`*-5.1.0`	All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery	November 17, 2022	5.1.1	High
`5.0.0-5.0.7`	All In One WP Security & Firewall 5.0.0 - 5.0.7 - Protection Bypass via IP Spoofing	September 30, 2022	5.0.8	Medium
`[*, 4.4.11)`	All In One WP Security & Firewall <= 4.4.10 - Open Redirect and Reflected Cross-Site Scripting	April 11, 2022	4.4.11	Medium
`[*, 4.4.6)`	All In One WP Security & Firewall <= 4.4.5 - Cross-Site Scripting	December 24, 2020	4.4.6	Medium
`*-4.4.3`	All In One WP Security & Firewall <= 4.4.3 - Reflected Cross-Site Scripting	September 8, 2020	4.4.4	Medium
`[*, 4.0.9)`	All In One WP Security & Firewall <= 4.0.8 - SQL Injection	August 14, 2019	4.0.9	Critical
`[*, 4.2.0)`	All In One WP Security & Firewall <= 4.1.9 - Reflected Cross-Site Scripting	November 11, 2016	4.2.0	Medium
`*-4.1.2`	All In One WP Security & Firewall <= 4.1.2 - Captcha Bypass	July 31, 2016	4.1.3	Medium
`[*, 4.0.7)`	All In One WP Security & Firewall <= 4.0.6 - SQL Injection	April 6, 2016	4.0.7	Critical
`[*, 4.0.6)`	All In One WP Security & Firewall <= 4.0.5 - Cross-Site Scripting	February 23, 2016	4.0.6	Medium
`[*, 4.0.5)`	All In One WP Security & Firewall <= 4.0.4 - Cross-Site Scripting	February 22, 2016	4.0.5	Medium
`[*, 3.9.8)`	All In One WP Security & Firewall <= 3.9.7 - Cross-Site Scripting	August 15, 2015	3.9.8	Medium
`[*, 3.9.5)`	All In One WP Security & Firewall <= 3.9.4 - Reflected Cross-Site Scripting	April 20, 2015	3.9.5	Medium
`[*, 3.9.1)`	All In One WP Security & Firewall <= 3.9.0 - SQL Injection	April 6, 2015	3.9.1	Critical
`[*, 3.8.8)`	All In One WP Security & Firewall <= 3.8.7 - SQL Injection	March 6, 2015	3.8.8	Critical

Selected source records

Latest Records

HighCVE-2026-8438

All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path

Published: June 5, 2026

Affected versions: *-5.4.7
Patched versions: 5.4.8

Original Wordfence record

MediumCVE-2024-30468

All In One WP Security <= 5.2.6 - Cross-Site Request Forgery to IP Blocking

Published: February 8, 2024

Affected versions: *-5.2.6
Patched versions: 5.2.7

Original Wordfence record

MediumCVE-2024-1037

All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting

Published: February 6, 2024

Affected versions: *-5.2.5
Patched versions: 5.2.6

Original Wordfence record

MediumCVE-2023-52147

All In One WP Security <= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding

Published: October 25, 2023

Affected versions: [*, 5.2.5)
Patched versions: 5.2.5

Original Wordfence record

Medium

All In One WP Security 5.1.9 - Plaintext Storage of Credentials

Published: July 11, 2023

Affected versions: 5.1.9
Patched versions: 5.2.0

Original Wordfence record

MediumCVE-2023-0157

All-In-One Security (AIOS) <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: March 20, 2023

Affected versions: *-5.1.4
Patched versions: 5.1.5

Original Wordfence record

MediumCVE-2023-0156

All-In-One Security (AIOS) <= 5.1.4 - Authenticated(Admin+) Directory Traversal

Published: February 14, 2023

Affected versions: *-5.1.4
Patched versions: 5.1.5

Original Wordfence record

MediumCVE-2022-4346

All-In-One Security <= 5.1.2 - Information Disclosure

Published: December 9, 2022

Affected versions: *-5.1.2
Patched versions: 5.1.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2016-10887

All In One WP Security & Firewall <= 4.0.8 - SQL Injection

Published: August 14, 2019

Affected versions: [*, 4.0.9)
Patched versions: 4.0.9

Original Wordfence record

CriticalCVE-2016-10888

All In One WP Security & Firewall <= 4.0.6 - SQL Injection

Published: April 6, 2016

Affected versions: [*, 4.0.7)
Patched versions: 4.0.7

Original Wordfence record

CriticalCVE-2015-9310

All In One WP Security & Firewall <= 3.9.0 - SQL Injection

Published: April 6, 2015

Affected versions: [*, 3.9.1)
Patched versions: 3.9.1

Original Wordfence record

CriticalCVE-2015-0894

All In One WP Security & Firewall <= 3.8.7 - SQL Injection

Published: March 6, 2015

Affected versions: [*, 3.8.8)
Patched versions: 3.8.8

Original Wordfence record

HighCVE-2022-44737

All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery

Published: November 22, 2022

Affected versions: *-5.1.0
Patched versions: 5.1.1

Original Wordfence record

High

All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery

Published: November 17, 2022

Affected versions: *-5.1.0
Patched versions: 5.1.1

Original Wordfence record

HighCVE-2014-6242

All In One WP Security & Firewall <= 3.8.2 - Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters

Published: September 24, 2014

Affected versions: [*, 3.8.3)
Patched versions: 3.8.3

Original Wordfence record

HighCVE-2026-8438

All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path

Published: June 5, 2026

Affected versions: *-5.4.7
Patched versions: 5.4.8

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory