WordPress all-in-one-seo-pack has 9 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-25036 | The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audi | high | 8.8 | <4.1.5.3 | 4.1.5.3 |
| CVE-2015-0902 | The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation | medium | 5.0 | <=2.2.5.1 | – |
| CVE-2023-0586 | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and inc | medium | 6.4 | <=4.2.9 | – |
| CVE-2019-16520 | The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of | medium | 5.4 | <3.2.7 | 3.2.7 |
| CVE-2021-25037 | The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an inter | medium | 6.5 | <4.1.5.3 | 4.1.5.3 |
| CVE-2013-5988 | A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter. | medium | 6.1 | >=1.3.6.4 and <=1.6.15.2 or >=2.0 and <2.0.3.1 | 2.0.3.1 |
| CVE-2020-35946 | An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to | medium | 5.4 | <3.6.2 | 3.6.2 |
| CVE-2023-0585 | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and inc | medium | 4.4 | <=4.2.9 | – |
| CVE-2024-3554 | The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored | medium | 6.4 | <4.6.1.1 | 4.6.1.1 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked