CVE-2015-0902: The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers

medium Affects all-in-one-seo-pack (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2015-04-03; advisory modified 2026-06-17.

The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers

Package: all-in-one-seo-pack (WordPress plugin) WordPress
Affected versions: <=2.2.5.1
Fixed in: no fix recorded
Severity: medium CVSS 5.0
Exploitation: not on CISA KEV · EPSS 3% (87.3th percentile)
Published: 2015-04-03
Source: nvd

References

CWE-200

NVD record all-in-one-seo-pack (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-25036 high The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation i same package: all-in-one-seo-pack (WordPress plugin)
CVE-2023-0586 medium The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting same package: all-in-one-seo-pack (WordPress plugin)
CVE-2019-16520 medium The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is sus same package: all-in-one-seo-pack (WordPress plugin)
CVE-2021-25037 medium The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL inj same package: all-in-one-seo-pack (WordPress plugin)
CVE-2013-5988 medium A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before same package: all-in-one-seo-pack (WordPress plugin)
CVE-2020-35946 medium An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The same package: all-in-one-seo-pack (WordPress plugin)