CVE-2026-8438

🗓️ 06 Jun 2026 01:26:10Reported by WordfenceType

Unauthenticated stored XSS in AIOS 5.4.7 via REST path when guest REST access is disabled and debug logging is on.

Reporter	Title	Published	Views	Family All 6
ATTACKERKB	CVE-2026-8438	6 Jun 202601:26	–	attackerkb
Circl	CVE-2026-8438	6 Jun 202604:50	–	circl
Cvelist	CVE-2026-8438 All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path	6 Jun 202601:26	–	cvelist
EUVD	EUVD-2026-34942	6 Jun 202601:26	–	euvd
NVD	CVE-2026-8438	6 Jun 202602:16	–	nvd
Positive Technologies	PT-2026-47122	6 Jun 202600:00	–	ptsecurity

Vulners

Node

davidanderson all-in-one_security_(aios)_security_and_firewallRange≤5.4.7wordpress

[
  {
    "vendor": "davidanderson",
    "product": "All-In-One Security (AIOS) – Security and Firewall",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.4.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-debug-logger.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-debug-logger.php
plugins	www.plugins.trac.wordpress.org/changeset/3558989/
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-utility.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-utility.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-general-init-tasks.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-debug.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/admin/wp-security-list-debug.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/d2b7ed73-a654-40ef-8d80-6171393da8e7

06 Jun 2026 02:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.2

CWE-79