Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: UpdraftPlus Component: All-in-one Security Clear all filters
TI-2024-00959 CVE-2024-1037 · GHSA-mfxx-xjx2-rcm9

All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting

Priority LOW 28

The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sa…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0055 Published 2024-02-07 No fix listed CWE-79
TI-2023-00152 CVE-2023-0157 · GHSA-jqhc-cx3v-qvf6

All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS

Priority MEDIUM 55

The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containin…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.32462 Published 2023-04-10 Fixed in 5.1.5 CWE-79
TI-2023-00151 CVE-2023-0156 · GHSA-vx24-mm4v-658f

All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

Priority MEDIUM 56

The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list director…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.19921 Published 2023-04-10 Fixed in 5.1.5 CWE-22
TI-2022-03979 CVE-2022-4346 · GHSA-5w78-c46h-gqxq

All In One WP Security & Firewall < 5.1.3 - Configuration Leak

Priority MEDIUM 63

The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00665 Published 2023-01-23 Fixed in 5.1.3
TI-2022-03745 CVE-2022-4097 · GHSA-79g9-878f-3c34

All In One WP Security & Firewall < 5.0.8 - IP Spoofing

Priority MEDIUM 57

The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00605 Published 2022-12-12 Fixed in 5.0.8 CWE-639