All In One Wp Security & Firewall

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:tipsandtricks-hq:all_in_one_wp_security_\&_firewall:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

VendorTipsandtricks Hq (526308cc-12ad-5324-8e9d-ae125b4b0839)
ProductAll In One Wp Security & Firewall (4f1561d9-1dfc-542c-83de-50bf927d62da)
Edition*
Language*
Software edition*
Target softwarewordpress
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-44737 vulnerable 2026-06-08 05:49:36.309757 WordPress All In One WP Security plugin <= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
MEDIUM (6.5)
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.
Published: 2022-11-22T16:00:10.628Z
Updated: 2026-04-28T16:07:51.676Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-25102 vulnerable 2026-06-08 05:30:39.965077 All In One WP Security < 4.4.11 - Authenticated Reflected Cross-Site Scripting
The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk
Published: 2022-05-02T16:05:32.000Z
Updated: 2024-08-03T19:56:10.670Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-10888 vulnerable 2026-06-08 05:07:25.785434 Details available
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
Published: 2019-08-14T15:19:24.000Z
Updated: 2024-08-06T03:38:56.762Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-10887 vulnerable 2026-06-08 05:07:25.785144 Details available
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
Published: 2019-08-14T15:20:27.000Z
Updated: 2024-08-06T03:38:56.578Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-10868 vulnerable 2026-06-08 05:07:25.764590 Details available
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Published: 2019-08-13T16:53:00.000Z
Updated: 2024-08-06T03:38:56.577Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-10867 vulnerable 2026-06-08 05:07:25.764288 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-10866 vulnerable 2026-06-08 05:07:25.763876 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-9310 vulnerable 2026-06-08 05:07:13.550409 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-9294 vulnerable 2026-06-08 05:07:13.534169 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-9293 vulnerable 2026-06-08 05:07:13.533770 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.