The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate sanitise and escape the redirect_to parameter before using it to redirect user either via a Location header or meta url attribute when the Rename Login Page is active which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known which should be hard to guess reducing the risk