CVE-2025-64295

WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1.

We have discovered 379,210 live websites that are affected by CVE-2025-64295.

Run a Free Instant Scan



Affected Software

Product  All in One SEO Pack
Category Search Engine Optimization
Vulnerable Domains379,210 live websites (60% of All in One SEO Pack install base)
Vulnerable Versions
  • from 0 through 4.8.6.1
Vulnerable Versions Count286 versions ( 92% of all versions)



Details

  • Published - Dec 18, 2025
  • Updated - Apr 29, 2026

Credits

  • Abu Hurayra | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2025-64295
United States77,044 websites


Japan118,713 websites
Russia23,792 websites
Germany20,264 websites
France12,318 websites
GB10,819 websites
Poland9,829 websites
Italy9,617 websites
Spain5,979 websites

Website Distribution by TLD

Number of websites using CVE-2025-64295
.com167,608 websites
.jp24,661 websites
.ru23,108 websites
.net16,735 websites
.co.jp16,135 websites
.org12,562 websites
.de10,618 websites
.pl7,643 websites
.it6,798 websites
.co.uk6,481 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-64295

Top websites that are affected by CVE-2025-64295. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.net Canada***
******.*******.org United States***
*********.org United States*,***
*********.com Italy*,***
******.at Germany*,***
*****.com United States*,***
*****.com United States*,***
*****.com United States*,***
******.com United States*,***
***.xyz United States*,***
See full domain list

FAQ

A total of 379,210 websites have been identified as vulnerable to CVE-2025-64295, based on global website indexing conducted by WebTechSurvey.
The All in One SEO Pack is affected by the CVE-2025-64295 vulnerability.
All in One SEO Pack versions up to and including 4.8.6.1 are vulnerable to CVE-2025-64295.