All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

Information

Software Type Plugin
Software Slug all-in-one-seo-pack (view on wordpress.org)
Software Status Active
Software Author smub
Software Website aioseo.com
Software Downloads 210,144,798
Software Active Installs 2,000,000
Software Record Last Updated September 9, 2026

Showing 1-20 of 28 Vulnerabilities

Submit a Vulnerability
All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
4.3
CVE-2026-5075
May 19, 2026
Researcher: 0x61626390
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure
4.3
CVE-2025-14384
Jan 15, 2026
Researcher: NosleeP++
All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2025-64295
Nov 26, 2025
Researcher: Abu Hurayra (HurayraIIT)
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion
4.3
CVE-2025-12847
Nov 14, 2025
Researcher: shark3y
All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2025-58649
Sep 22, 2025
Researcher: Abu Hurayra (HurayraIIT)
All in One SEO <= 2.2.4.1 - Privilege Escalation to Arbitrary Post Modification
4.3
CVE ID Unknown
May 31, 2014
Researcher: Marc-Alexandre Montpas
All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-0585
Feb 24, 2023
Researchers: Marco Wotschka, Ivan Kuzymchak
All in One SEO < 4.9.9 - Missing Authorization
5.3
CVE-2026-10755
Jun 29, 2026
Researcher: WPscan
All in One SEO <= 2.2.5.1 - Information Disclosure
5.3
CVE-2015-0902
Mar 31, 2015
Researcher: Fumito MIZUNO
All In One SEO Pack <= 4.8.7.1 - Missing Authorization
5.4
CVE-2025-58650
Sep 22, 2025
Researcher: Abu Hurayra (HurayraIIT)
All in One SEO <= 2.2.6.1 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Apr 20, 2015
Researchers:
All in One SEO <= 2.0.3 - Cross-Site Scripting via Search Parameter
6.1
CVE-2013-5988
Aug 1, 2014
Researchers: Charlie Briggs, Richard Clifford
All in One SEO <= 2.1.5 - Missing Authorization
6.3
CVE ID Unknown
May 31, 2014
Researcher: Marc-Alexandre Montpas
All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL
6.4
CVE-2025-2892
May 18, 2025
Researcher: Ivan Kuzymchak
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-3554
Apr 29, 2024
Researcher: Krzysztof Zając
All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-3368
Apr 29, 2024
Researcher: Dmitrii Ignatyev
All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-0586
Feb 24, 2023
Researcher: Ivan Kuzymchak
All in One SEO Pack <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2020-35946
Jul 16, 2020
Researcher: Chloe Chamberland
All In One SEO Pack <= 3.2.6 - Stored Cross-Site Scripting
6.4
CVE-2019-16520
Oct 16, 2019
Researcher: Tobias Fink
All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting
6.4
CVE ID Unknown
Oct 18, 2018
Researcher: RIPS Technologies
Title Status CVE ID CVSS Researchers Date
All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data Patched CVE-2026-5075 4.3 0x61626390 May 19, 2026
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure Patched CVE-2025-14384 4.3 NosleeP++ January 15, 2026
All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure Patched CVE-2025-64295 4.3 Abu Hurayra (HurayraIIT) November 26, 2025
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion Patched CVE-2025-12847 4.3 shark3y November 14, 2025
All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure Patched CVE-2025-58649 4.3 Abu Hurayra (HurayraIIT) September 22, 2025
All in One SEO <= 2.2.4.1 - Privilege Escalation to Arbitrary Post Modification Patched 4.3 Marc-Alexandre Montpas May 31, 2014
All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2023-0585 4.4 Marco Wotschka, Ivan Kuzymchak February 24, 2023
All in One SEO < 4.9.9 - Missing Authorization Patched CVE-2026-10755 5.3 WPscan June 29, 2026
All in One SEO <= 2.2.5.1 - Information Disclosure Patched CVE-2015-0902 5.3 Fumito MIZUNO March 31, 2015
All In One SEO Pack <= 4.8.7.1 - Missing Authorization Patched CVE-2025-58650 5.4 Abu Hurayra (HurayraIIT) September 22, 2025
All in One SEO <= 2.2.6.1 - Reflected Cross-Site Scripting Patched 6.1 April 20, 2015
All in One SEO <= 2.0.3 - Cross-Site Scripting via Search Parameter Patched CVE-2013-5988 6.1 Charlie Briggs, Richard Clifford August 1, 2014
All in One SEO <= 2.1.5 - Missing Authorization Patched 6.3 Marc-Alexandre Montpas May 31, 2014
All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL Patched CVE-2025-2892 6.4 Ivan Kuzymchak May 18, 2025
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-3554 6.4 Krzysztof Zając April 29, 2024
All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-3368 6.4 Dmitrii Ignatyev April 29, 2024
All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2023-0586 6.4 Ivan Kuzymchak February 24, 2023
All in One SEO Pack <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2020-35946 6.4 Chloe Chamberland July 16, 2020
All In One SEO Pack <= 3.2.6 - Stored Cross-Site Scripting Patched CVE-2019-16520 6.4 Tobias Fink October 16, 2019
All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting Patched 6.4 RIPS Technologies October 18, 2018

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation