CVE-2026-8438 All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path

🗓️ 06 Jun 2026 01:26:10Reported by WordfenceType

Unauthenticated stored XSS in All-In-One Security up to 5.4.7 through REST path with debug logging.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-8438	6 Jun 202601:26	–	attackerkb
Circl	CVE-2026-8438	6 Jun 202604:50	–	circl
CVE	CVE-2026-8438	6 Jun 202601:26	–	cve
EUVD	EUVD-2026-34942	6 Jun 202601:26	–	euvd
NVD	CVE-2026-8438	6 Jun 202602:16	–	nvd
Patchstack	WordPress All-In-One Security (AIOS) – Security and Firewall plugin <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting vulnerability	9 Jun 202609:43	–	patchstack
Positive Technologies	PT-2026-47122	6 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-8438	7 Jun 202608:59	–	redhatcve
Vulnrichment	CVE-2026-8438 All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path	6 Jun 202601:26	–	vulnrichment

[
  {
    "vendor": "davidanderson",
    "product": "All-In-One Security (AIOS) – Security and Firewall",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.4.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/d2b7ed73-a654-40ef-8d80-6171393da8e7
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-utility.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-general-init-tasks.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-debug-logger.php
plugins	www.plugins.trac.wordpress.org/changeset/3558989/
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-utility.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-debug.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-debug-logger.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/admin/wp-security-list-debug.php

06 Jun 2026 01:26Current

CVSS 3.17.2

EPSS0.00125

CWE-79