What is the CVSS score of CVE-2026-8438?

CVE-2026-8438 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of AIOS WordPress Plugin are affected by CVE-2026-8438?

The All-In-One Security (AIOS) WordPress plugin through version 5.4.7 contains a stored cross-site scripting vulnerability exploitable by unauthenticated attackers to inject code executed in…

How to fix or mitigate CVE-2026-8438?

Within 24 hours: Identify all WordPress installations running AIOS ≤5.4.7; document whether the two specific vulnerable configuration settings mentioned in the Wordfence advisory are simultaneously enabled. Within 7 days: Disable AIOS plugin entirely or restrict access to the debug logs page at network and application levels; implement compensating controls. Within 30 days: Monitor Wordfence security advisories and AIOS release channels for patch availability; apply immediately upon release and audit administrator session logs for unauthorized activity dating back 90 days.

AIOS WordPress Plugin CVE-2026-8438

EUVD-2026-34942 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-06 Wordfence

GHSA-p64v-fh44-3cqj

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 02:29 vuln.today

CVE Published

Jun 06, 2026 - 01:26 nvd

HIGH 7.2

DescriptionCVE.org

The All-In-One Security (AIOS) - Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page, enabling nonce theft, privileged AJAX/REST actions, and potential full site compromise.

AnalysisAI

Stored cross-site scripting in the All-In-One Security (AIOS) WordPress plugin through version 5.4.7 allows unauthenticated attackers to inject JavaScript that executes when administrators view the debug logs page. The flaw was reported by Wordfence and requires two specific plugin settings to be enabled simultaneously, and no public exploit identified at time of analysis. Successful exploitation enables nonce theft and privileged actions on behalf of the administrator, potentially leading to full site takeover.

Technical ContextAI

The vulnerability lives in the AIOS plugin's debug logging pipeline. When the 'Disable REST API for non-logged in users' guard (aiowps_disallow_unauthorized_rest_requests) blocks an anonymous REST call, the plugin calls get_rest_route() which invokes urldecode($_SERVER['REQUEST_URI']) - converting URL-encoded payloads into literal HTML characters - and then concatenates that decoded path into a debug log entry stored in the database. Later, when an administrator opens the AIOS Debug Logs page, the column_default() method in wp-security-list-debug.php returns the raw stored value and the WordPress WP_List_Table parent echoes it without escaping. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) chain combining missing input sanitization at the entry point and missing output escaping at the sink, and it affects the davidanderson all-in-one_security_(aios) CPE for all versions up to and including 5.4.7.

RemediationAI

Upstream fix available via WordPress.org plugin changeset 3558989 (https://plugins.trac.wordpress.org/changeset/3558989/); a released patched version is not independently confirmed in the supplied data, so administrators should upgrade to the latest AIOS release published after that changeset and verify via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b7ed73-a654-40ef-8d80-6171393da8e7. Until the upgrade is applied, two effective compensating controls are to disable the plugin's debug logging by turning off aiowps_enable_debug - this breaks the storage sink and prevents any payload from being persisted, at the cost of losing AIOS diagnostic logs - or to disable the 'Disable REST API for non-logged in users' option (aiowps_disallow_unauthorized_rest_requests), which removes the code path that captures the unauthenticated REST URI, at the cost of weakening REST hardening for anonymous clients. As an additional layer, restrict access to /wp-admin and the AIOS Debug Logs page to trusted IPs so that administrators are less likely to render stored payloads, and clear any existing debug log entries after patching to remove payloads that may already be persisted in the database.