CVE-2026-8438
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The All-In-One Security (AIOS) plugin for WordPress up to version 5.4.7 is vulnerable to Stored XSS. An unauthenticated attacker can inject arbitrary HTML/JavaScript into the REST request path, which is stored in debug logs. When an admin views the debug log page, the script executes in their browser.
Risk Assessment
An attacker can steal nonces, perform privileged AJAX/REST actions, and potentially compromise the entire WordPress site.
Recommendation
Update the All-In-One Security plugin to version 5.4.8 or later.
Related vulnerabilities
- CVE-2026-86296Critical
A vulnerability was found in D-Link DIR-822A A_101 in the strcpy function of the file udhcpcd/serverpacket.c in the udhcpcd component. This manipulation causes a stack-based buffer overflow. The attack can be carried out remotely and the exploit is publicly disclosed.
- CVE-2026-79698Critical
A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the nodered_lib_apply function of the Node-RED Library component. Manipulation of the argument act leads to command injection. The attack can be launched remotely and the exploit is publicly available. The vendor released a fix in version 1.2.4_20260821.
- CVE-2026-79697Critical
A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component. Manipulation of the argument act causes command injection. The attack can be initiated remotely and the exploit is publicly disclosed. The vendor released a fix in version 1.2.4_20260821.
- CVE-2026-16876Critical
An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.
- CVE-2026-86167Critical
A vulnerability was identified in Tenda HG10 (version 300001138) in the formgponConf function of the /boaform/admin/formgponConf file in the Boa component. Manipulation of the fmgpon_loid argument leads to OS command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86165Critical
A vulnerability was found in Tenda HG10 (version 300001138) in the formURL function of the /boaform/admin/formURL file. Manipulation of the Keywd/urlFQDN arguments results in a buffer overflow. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-86218Critical
N-central is vulnerable to pre-auth remote code execution. This issue affects N-central before version 2026.3.1.14.
- CVE-2026-75816Critical
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to and including 3.29.12. The pre_update_value function lacks capability or ownership checks, and ActionPost::conditions_logic() short-circuits the current_user_can('edit_post') authorization gate when the post ID is non-numeric, allowing unauthenticated form submissions to be routed to arbitrary user records. This enables unauthenticated attackers to overwrite any user's email address, including an administrator's, and then use WordPress's native password-reset flow to take over the account.
- CVE-2026-16310Critical
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.8.5 via the 'id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification to the victim.
- CVE-2026-86153Critical
A vulnerability has been found in Tenda CP3 (version 27.5.57.101) in the CRedirServer::SetRedirectEnable function of the Functions/Redirect.cpp file. The manipulation leads to improper privilege management. Remote exploitation is possible.
Original NVD description (English source)
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page, enabling nonce theft, privileged AJAX/REST actions, and potential full site compromise.