CVE-2026-8438: All-In-One Security Plugin Stored XSS in Debug Logs

Technical summary

CVE-2026-8438 is a stored XSS vulnerability in the AIOS plugin's debug logging mechanism. The root cause lies in two implementation gaps: (1) the get_rest_route() function retrieves and URL-decodes the REQUEST_URI without sanitizing the result, and (2) the column_default() method in the debug log list table fails to escape output before display. When an unauthenticated attacker sends a request with URL-encoded HTML or JavaScript in the path and both the aiowps_disallow_unauthorized_rest_requests and aiowps_enable_debug options are active, the decoded payload is written verbatim to the debug log in the database. Upon administrator access to the Debug Logs page, the unsanitized value flows through the list table rendering without escaping, causing browser execution of the stored payload. This attack chain bypasses the REST API restriction by exploiting the logging function itself rather than requiring authentication.

Business impact

Stored XSS vulnerabilities in WordPress admin panels pose direct operational and security risks. An attacker can harvest administrator session tokens or nonces, then use those stolen credentials to perform privileged actions such as creating malicious user accounts, installing backdoored plugins, or modifying site content. The attack surface is particularly broad because triggering the vulnerability requires only a single unauthenticated HTTP request—no user interaction beyond normal site administration is needed. For multi-site WordPress installations, compromise of an administrator session can lead to lateral movement across multiple properties. Organizations relying on AIOS for security hardening face the irony of a security plugin becoming an attack vector if left unpatched.

Affected systems

WordPress installations running All-In-One Security (AIOS) plugin version 5.4.7 and earlier are affected. The vulnerability is only exploitable when both of the following plugin settings are enabled: 'Disable REST API for non-logged in users' and debug logging. Sites with only one of these features enabled are not vulnerable. Since AIOS is a free plugin available on the WordPress plugin repository, exposure is potentially widespread across small-to-medium business WordPress sites and shared hosting environments.

Exploitability

The vulnerability is straightforward to exploit. An attacker needs only to craft an HTTP request with URL-encoded JavaScript in the path—no authentication, no user interaction, and no complex pre-conditions beyond the two plugin settings being enabled. The CVSS score of 7.2 reflects the high accessibility (network-based, low complexity, no privileges required) and the fact that exploitation does not require administrator clicks or social engineering. However, the payload must persist and be viewed by an administrator for the attack to succeed, and administrators must have access to the Debug Logs page. Detection by the attacker cannot be guaranteed without additional reconnaissance.

Remediation

Update the All-In-One Security plugin to a patched version that sanitizes the REQUEST_URI in the get_rest_route() function and applies proper output escaping in the column_default() method. Verify the patch version against the official AIOS plugin repository or vendor advisory. As an interim measure, if immediate patching is not possible, disable either the 'Disable REST API for non-logged in users' feature or debug logging—doing so will prevent the vulnerability from being triggered, though this may impact your intended security posture or troubleshooting capability.

Patch guidance

Check the All-In-One Security plugin's release notes and security advisories on the official WordPress plugin repository or the plugin vendor's website for the first version that addresses CVE-2026-8438. Enable automatic plugin updates in WordPress to receive patches promptly, or manually update the plugin from the Plugins page in the WordPress admin dashboard. After updating, verify that both the 'Disable REST API for non-logged in users' and debug logging features are configured according to your security requirements; patching removes the vulnerability, but re-enabling these features is safe only after the patch is applied.

Detection guidance

Search your WordPress debug logs and web server access logs for requests containing URL-encoded characters followed by angle brackets or script tags in the REQUEST_URI—patterns such as %3C%73%63%72%69%70%74 (encoded '<script') are indicators of potential exploitation attempts. Monitor the AIOS Debug Logs page for entries containing raw HTML or JavaScript; legitimate debug entries should not include such content. If you have access to the WordPress database, query the debug log table for rows containing '<script', '<iframe', 'javascript:', or other XSS payloads. Note any timestamps and cross-reference them with administrator login records to determine if malicious sessions were created. Web application firewalls (WAF) can be configured to flag requests with URL-encoded script tags in the path.

Why prioritize this

Although CVE-2026-8438 is not yet listed in CISA's Known Exploited Vulnerabilities catalog, the combination of high CVSS score (7.2), zero authentication requirement, and the ubiquity of WordPress as a platform makes this a medium-to-high priority for patching. Organizations using AIOS should treat this as urgent if the plugin is active with debug logging enabled, as an unauthenticated remote attacker can directly inject malicious code into administrator sessions. The stored nature of the XSS also means that other administrators could be compromised by simply checking logs after an attack occurs, multiplying the blast radius.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects: Attack Vector = Network (anyone on the internet can send a request), Attack Complexity = Low (no special conditions or timing required beyond enabling two plugin settings), Privileges Required = None (no authentication needed), User Interaction = None (payload executes when admin views logs, not requiring additional clicks), Scope = Changed (the attacker's impact extends beyond the AIOS plugin to the full WordPress site and potentially the WordPress network), Confidentiality = Low (session tokens and credentials can be exfiltrated), and Integrity = Low (site content and configuration can be modified). The score does not include Availability impact because the vulnerability does not directly crash or disable services, though a compromised site could suffer availability degradation from malicious changes.

Frequently asked questions