Stored Cross-Site Scripting Vulnerability in All-In-One Security Plugin by WordPress
CVE-2026-8438

7.2HIGH

Key Information:

Vendor

WordPress
Status
All-in-one Security (aiOS) – Security And Firewall
Vendor
CVE Published:
6 June 2026

What is CVE-2026-8438?

The All-In-One Security plugin for WordPress is prone to Stored Cross-Site Scripting due to poor input sanitization in the get_rest_route() function and inadequate output escaping in the debug log handling methods. Specifically, if the 'Disable REST API for non-logged in users' feature is enabled alongside debug logging, an unauthenticated attacker can exploit this vulnerability by sending malicious HTML or JavaScript through the REST request path. This compromised input is stored in the database and can be executed in the admin's browser when viewed on the dashboard. This allows attackers to potentially execute malicious scripts, steal nonces, and perform privileged actions, posing a severe risk to site security.

Affected Version(s)

All-In-One Security (AIOS) – Security and Firewall 0 <= 5.4.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/all-in-one-wp-...
https://plugins.trac.wordpress.org/browser/all-in-one-wp-...

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.