PLUGIN SECURITY
Is All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) safe?
AIOSEO is the WordPress SEO plugin. Boost SEO rankings with AI SEO tools, schema, meta descriptions, XML sitemaps & rank tracking.
What this plugin does
- Slug:
all-in-one-seo-pack - Author: Syed Balkhi
- 3000000+ active installs
- 94/100 rating (5199 reviews on wordpress.org)
- 208413054 all-time downloads
- On WordPress.org since 2007-03-30
AIredirectschemaseoxml sitemap
Maintenance status
- Latest known version: 5.0.0.1
- Last updated: 2026-08-03 7:34pm GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.2+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
21 known CVEs on file for All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights).
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-10755 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.9 | Incorrect Authorization | Unknown | < 4.9.9 | 4.9.9 | 2026-06-29 | ✓ fixed in latest |
| CVE-2026-5075 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.7.1 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 4.9.7.1 | 4.9.7.1 | 2026-05-19 | ✓ fixed in latest |
| CVE-2025-14384 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.3 | Missing Authorization | Medium 4.3 | < 4.9.3 | 4.9.3 | 2026-01-15 | ✓ fixed in latest |
| CVE-2025-67950 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.1.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.5 | < 4.9.1.1 | 4.9.1.1 | 2025-12-06 | ✓ fixed in latest |
| CVE-2025-64295 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.8.7 | Insertion of Sensitive Information Into Sent Data | Medium 6.5 | < 4.8.7 | 4.8.7 | 2025-11-26 | ✓ fixed in latest |
| CVE-2025-12847 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.0 | Missing Authorization | Medium 4.3 | < 4.9.0 | 4.9.0 | 2025-11-14 | ✓ fixed in latest |
| CVE-2025-58650 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.8.7.2 | — | Medium 5.4 | < 4.8.7.2 | 4.8.7.2 | 2025-09-22 | ✓ fixed in latest |
| CVE-2024-3554 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.6.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.6.1.1 | 4.6.1.1 | 2024-04-29 | ✓ fixed in latest |
+ 40 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-3368 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.6.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.6.1.1 | 4.6.1.1 | 2024-04-29 | ✓ fixed in latest |
| CVE-2023-0586 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.3.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.3.0 | 4.3.0 | 2023-02-24 | ✓ fixed in latest |
| CVE-2023-0585 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.3.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.3.0 | 4.3.0 | 2023-02-24 | ✓ fixed in latest |
| CVE-2022-38093 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.2.4 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 4.2.4 | 4.2.4 | 2022-09-05 | ✓ fixed in latest |
| CVE-2021-25036 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.1.5.3 | Improper Handling of Case Sensitivity | High 8.8 | < 4.1.5.3 | 4.1.5.3 | 2021-12-14 | ✓ fixed in latest |
| CVE-2021-25037 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.1.5.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 4.1.5.3 | 4.1.5.3 | 2021-12-14 | ✓ fixed in latest |
| CVE-2021-24307 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.1.0.2 | Deserialization of Untrusted Data | High 8.8 | < 4.1.0.2 | 4.1.0.2 | 2021-05-09 | ✓ fixed in latest |
| CVE-2020-35946 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 3.6.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.6.2 | 3.6.2 | 2020-07-16 | ✓ fixed in latest |
| CVE-2019-16520 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 3.2.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.2.7 | 3.2.7 | 2019-10-16 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.10 | — | Unknown | < 2.10 | 2.10 | 2018-10-18 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.7 | — | Unknown | < 2.3.7 | 2.3.7 | 2016-07-19 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.8 | — | Unknown | < 2.3.8 | 2.3.8 | 2016-07-19 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.8 | — | Unknown | < 2.3.8 | 2.3.8 | 2016-07-13 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.6.2 | — | Unknown | < 2.3.6.2 | 2.3.6.2 | 2016-07-11 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.7 | — | Unknown | < 2.3.7 | 2.3.7 | 2016-07-01 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.6.2 | — | Unknown | < 2.2.6.2 | 2.2.6.2 | 2015-09-09 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6 | — | Unknown | < 2.1.6 | 2.1.6 | 2015-05-15 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6 | — | Unknown | < 2.1.6 | 2.1.6 | 2015-05-15 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.6.2 | — | Unknown | < 2.2.6.2 | 2.2.6.2 | 2015-04-20 | ✓ fixed in latest |
| CVE-2015-0902 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.6 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 2.2.6 | 2.2.6 | 2015-01-08 | ✓ fixed in latest |
| CVE-2013-5988 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.0.3.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.0.3.1 | 2.0.3.1 | 2014-08-01 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.5 | — | Unknown | < 2.2.5 | 2.2.5 | 2014-05-31 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6 | — | Unknown | < 2.1.6 | 2.1.6 | 2014-05-31 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6 | — | Unknown | < 2.1.6 | 2.1.6 | 2014-05-31 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.8.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.8.2 | 4.8.2 | 0000-00-00 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.8.7.2 | — | Medium 4.3 | < 4.8.7.2 | 4.8.7.2 | 0000-00-00 | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.10 | — | Unknown | < 2.10 | 2.10 | — | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.8 | — | Unknown | < 2.3.8 | 2.3.8 | — | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.3.7 | — | Unknown | < 2.3.7 | 2.3.7 | — | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.2.6.2 | — | Unknown | < 2.2.6.2 | 2.2.6.2 | — | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6 | — | Unknown | < 2.1.6 | 2.1.6 | — | ✓ fixed in latest |
| — | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 2.1.6 | — | Unknown | < 2.1.6 | 2.1.6 | — | ✓ fixed in latest |
| — | All in One SEO Pack <= 2.1.5 - aioseop_functions.php new_meta Parameter XSS | — | Unknown | < 2.1.6 | 2.1.6 | — | ✓ fixed in latest |
| — | All in One SEO Pack <= 2.1.5 - Unspecified Privilege Escalation | — | Unknown | < 2.1.6 | 2.1.6 | — | ✓ fixed in latest |
| — | All in One SEO Pack <= 2.2.6.1 - Cross-Site Scripting (XSS) | — | Unknown | < 2.2.6.2 | 2.2.6.2 | — | ✓ fixed in latest |
| — | All in One SEO Pack < 2.3.7 - Unauthenticated Stored Cross-Site Scripting (XSS) | — | Unknown | < 2.3.7 | 2.3.7 | — | ✓ fixed in latest |
| — | All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting (XSS) | — | Unknown | < 2.3.8 | 2.3.8 | — | ✓ fixed in latest |
| — | All in One SEO Pack < 2.10 - Authenticated Stored Cross-Site Scripting (XSS) | — | Unknown | < 2.10 | 2.10 | — | ✓ fixed in latest |
| CVE-2025-2892 | All in One SEO Pack < 4.8.2 - Contributor+ Stored XSS via Post Meta Description and Canonical URL | — | Unknown | < 4.8.2 | 4.8.2 | — | ✓ fixed in latest |
| CVE-2025-58649 | All In One SEO Pack < 4.8.7.2 - Contributor+ Sensitive Information Exposure | — | Unknown | < 4.8.7.2 | 4.8.7.2 | — | ✓ fixed in latest |
How to fix it
Keep All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) updated — 5.0.0.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Redirection — 2000000+ active installs — 88/100 (702) — max PHP 8.4
- AI Agent by SiteGround — 1000000+ active installs — 30/100 (89) — max PHP <8.0
- 301 Redirects – Redirect Manager — 300000+ active installs — 94/100 (578) — max PHP 8.4
- Redirection for Contact Form 7 — 200000+ active installs — 94/100 (275) — max PHP 8.4
- Angie – Agentic AI — 100000+ active installs — 60/100 (15) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.