Updraftplus All-In-One Security vulnerabilities
5 known vulnerabilities affecting updraftplus/all-in-one_security.
Total CVEs
5
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM5
Vulnerabilities
Page 1 of 1
CVE-2023-0156P3MEDIUMCVSS 4.9fixed in 5.1.52023-04-10
CVE-2023-0156 [MEDIUM] CWE-22 CVE-2023-0156: The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to displa
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
nvd
CVE-2023-0157P4MEDIUMCVSS 4.8fixed in 5.1.52023-04-10
CVE-2023-0157 [MEDIUM] CWE-79 CVE-2023-0157: The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log file
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
nvd
CVE-2022-4346P4MEDIUMCVSS 5.3fixed in 5.1.32023-01-23
CVE-2022-4346 [MEDIUM] CWE-552 CVE-2022-4346: The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly,
The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.
nvd
CVE-2022-4097P4MEDIUMCVSS 5.3fixed in 5.0.82022-12-12
CVE-2022-4097 [MEDIUM] CWE-639 CVE-2022-4097: The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks,
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).
nvd
CVE-2024-1037P4MEDIUMCVSS 6.1fixed in 5.2.62024-02-07
CVE-2024-1037 [MEDIUM] CWE-79 CVE-2024-1037: The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflect
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exe
nvd