All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

Information

Software Type Plugin
Software Slug all-in-one-seo-pack (view on wordpress.org)
Software Status Active
Software Author smub
Software Website aioseo.com
Software Downloads 207,041,563
Software Active Installs 3,000,000
Software Record Last Updated July 21, 2026

Showing 1-20 of 27 Vulnerabilities

Submit a Vulnerability
All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
4.3
CVE-2026-5075
May 19, 2026
Researcher: 0x61626390
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure
4.3
CVE-2025-14384
Jan 15, 2026
Researcher: NosleeP++
All In One SEO Pack <= 4.9.1 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2025-67950
Dec 6, 2025
Researcher: Drew Webber (mcdruid)
All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2025-64295
Nov 26, 2025
Researcher: Abu Hurayra (HurayraIIT)
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion
4.3
CVE-2025-12847
Nov 14, 2025
Researcher: shark3y
All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2025-58649
Sep 22, 2025
Researcher: Abu Hurayra (HurayraIIT)
All In One SEO Pack <= 4.8.7.1 - Missing Authorization
5.4
CVE-2025-58650
Sep 22, 2025
Researcher: Abu Hurayra (HurayraIIT)
All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL
6.4
CVE-2025-2892
May 18, 2025
Researcher: Ivan Kuzymchak
All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-3368
Apr 29, 2024
Researcher: Dmitrii Ignatyev
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-3554
Apr 29, 2024
Researcher: Krzysztof Zając
All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-0586
Feb 24, 2023
Researcher: Ivan Kuzymchak
All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-0585
Feb 24, 2023
Researchers: Marco Wotschka, Ivan Kuzymchak
All in One SEO <= 4.2.3.1 - Cross-Site Request Forgery
8.8
CVE-2022-38093
Sep 5, 2022
Researcher: Rafie Muhammad
All in One SEO 4.1.3.1 - 4.1.5.2 - Authenticated SQL Injection
9.6
CVE-2021-25037
Dec 14, 2021
Researcher: Marc-Alexandre Montpas
All in One SEO 4.0.0 - 4.1.5.2 Authorization Bypass
8.8
CVE-2021-25036
Dec 14, 2021
Researcher: Marc-Alexandre Montpas
All in One SEO <= 4.1.0.1 - Authenticated Code Injection
8.8
CVE-2021-24307
May 9, 2021
Researcher: Vincent MICHEL
All in One SEO Pack <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2020-35946
Jul 16, 2020
Researcher: Chloe Chamberland
All In One SEO Pack <= 3.2.6 - Stored Cross-Site Scripting
6.4
CVE-2019-16520
Oct 16, 2019
Researcher: Tobias Fink
All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting
6.4
CVE ID Unknown
Oct 18, 2018
Researcher: RIPS Technologies
All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE ID Unknown
Jul 13, 2016
Researcher: Panagiotis Vagenas
Title Status CVE ID CVSS Researchers Date
All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data Patched CVE-2026-5075 4.3 0x61626390 May 19, 2026
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure Patched CVE-2025-14384 4.3 NosleeP++ January 15, 2026
All In One SEO Pack <= 4.9.1 - Authenticated (Contributor+) SQL Injection Patched CVE-2025-67950 6.5 Drew Webber (mcdruid) December 6, 2025
All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure Patched CVE-2025-64295 4.3 Abu Hurayra (HurayraIIT) November 26, 2025
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion Patched CVE-2025-12847 4.3 shark3y November 14, 2025
All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure Patched CVE-2025-58649 4.3 Abu Hurayra (HurayraIIT) September 22, 2025
All In One SEO Pack <= 4.8.7.1 - Missing Authorization Patched CVE-2025-58650 5.4 Abu Hurayra (HurayraIIT) September 22, 2025
All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL Patched CVE-2025-2892 6.4 Ivan Kuzymchak May 18, 2025
All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-3368 6.4 Dmitrii Ignatyev April 29, 2024
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-3554 6.4 Krzysztof Zając April 29, 2024
All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2023-0586 6.4 Ivan Kuzymchak February 24, 2023
All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2023-0585 4.4 Marco Wotschka, Ivan Kuzymchak February 24, 2023
All in One SEO <= 4.2.3.1 - Cross-Site Request Forgery Patched CVE-2022-38093 8.8 Rafie Muhammad September 5, 2022
All in One SEO 4.1.3.1 - 4.1.5.2 - Authenticated SQL Injection Patched CVE-2021-25037 9.6 Marc-Alexandre Montpas December 14, 2021
All in One SEO 4.0.0 - 4.1.5.2 Authorization Bypass Patched CVE-2021-25036 8.8 Marc-Alexandre Montpas December 14, 2021
All in One SEO <= 4.1.0.1 - Authenticated Code Injection Patched CVE-2021-24307 8.8 Vincent MICHEL May 9, 2021
All in One SEO Pack <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2020-35946 6.4 Chloe Chamberland July 16, 2020
All In One SEO Pack <= 3.2.6 - Stored Cross-Site Scripting Patched CVE-2019-16520 6.4 Tobias Fink October 16, 2019
All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting Patched 6.4 RIPS Technologies October 18, 2018
All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting Patched 7.2 Panagiotis Vagenas July 13, 2016

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation