CVE-2026-8438: WordPress AIOS Plugin XSS Vulnerability

CVE-2026-8438 Overview

CVE-2026-8438 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the All-In-One Security (AIOS) – Security and Firewall plugin for WordPress, affecting versions up to and including 5.4.7. The flaw exists in the get_rest_route() function due to insufficient input sanitization and missing output escaping in the column_default() method of the debug log list table. Unauthenticated attackers can inject arbitrary HTML or JavaScript through the REST request path when specific plugin features are enabled. The payload executes in an administrator's browser when they view the AIOS Dashboard Debug Logs page.

Critical Impact
Successful exploitation enables nonce theft, privileged AJAX/REST actions executed as an administrator, and potential full WordPress site compromise.

Affected Products

All-In-One Security (AIOS) – Security and Firewall plugin for WordPress
Versions up to and including 5.4.7
WordPress sites with both aiowps_disallow_unauthorized_rest_requests and aiowps_enable_debug enabled

Discovery Timeline

2026-06-06 - CVE-2026-8438 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-8438

Vulnerability Analysis

The vulnerability is a stored XSS issue in the AIOS plugin's debug logging pipeline. When the Disable REST API for non-logged in users feature is enabled alongside debug logging, the plugin intercepts unauthenticated REST requests and writes details to the debug log. The path retrieval relies on urldecode($_SERVER['REQUEST_URI']), which converts URL-encoded payloads into literal HTML characters. The decoded value is concatenated directly into a debug log message and persisted to the database without sanitization.

When an administrator opens the AIOS Dashboard Debug Logs page, the column_default() method returns the raw stored value, and the parent list table echoes it directly. The browser then renders attacker-supplied HTML and executes injected JavaScript in the administrator's session.

Root Cause

The root cause is the combination of two defects. First, input sanitization is missing in get_rest_route() before the REST path is logged. Second, output escaping is absent in the column_default() method of wp-security-list-debug.php when rendering log rows in the administrative dashboard.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the WordPress REST endpoint with a URL-encoded JavaScript payload embedded in the request URI. The plugin decodes the URI, writes the payload into the debug log table, and stores it persistently. The script later executes when a logged-in administrator views the debug log page, enabling nonce theft and privileged action execution.

For technical details, refer to the Wordfence Vulnerability Analysis and the WordPress Changeset #3558989.

Detection Methods for CVE-2026-8438

Indicators of Compromise

Unauthenticated REST API requests containing URL-encoded HTML or JavaScript tokens such as %3Cscript%3E, %3Cimg, or onerror%3D in the request URI.
Entries in the AIOS debug log table containing literal <script>, <img, or event-handler attributes within the REST path field.
Unexpected outbound requests or new administrative user accounts created shortly after an administrator visited the AIOS Debug Logs page.
Modifications to plugins, themes, or wp_options table values that correlate with admin debug log views.

Detection Strategies

Inspect web server access logs for unauthenticated requests to /wp-json/ paths containing encoded angle brackets or script keywords.
Query the AIOS debug log table for rows whose REST path column contains <, >, or javascript: substrings.
Monitor for WordPress administrator sessions issuing privileged AJAX or REST calls that did not originate from explicit user interaction.

Monitoring Recommendations

Enable file integrity monitoring on WordPress core, plugin, and theme directories to detect unauthorized modifications.
Forward WordPress and web server logs into a centralized analytics platform to correlate REST request payloads with administrator activity.
Alert on creation of new administrator accounts and changes to active plugin lists.

How to Mitigate CVE-2026-8438

Immediate Actions Required

Update the All-In-One Security (AIOS) – Security and Firewall plugin to the version released after 5.4.7 that incorporates the fix from WordPress Changeset #3558989.
Audit the AIOS debug log table for malicious entries and purge any rows containing HTML or JavaScript payloads.
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.
Review administrator-only configuration for unauthorized changes such as new users, modified plugins, or altered site URLs.

Patch Information

The vendor addressed CVE-2026-8438 in the AIOS plugin source tree. The fix adds proper sanitization of the REST request path before logging and applies output escaping in the debug log list table. Source-level changes are visible in the WordPress Debug List File and the WordPress Debug Logger File.

Workarounds

Disable the aiowps_enable_debug setting to prevent unauthenticated REST paths from being written to the debug log table.
Disable the aiowps_disallow_unauthorized_rest_requests feature until the plugin can be updated, since both flags must be active to trigger the logging path.
Restrict access to the WordPress /wp-admin/ interface using IP allowlists or a web application firewall rule that blocks REST requests containing encoded script payloads.

bash

# Configuration example: WAF rule pattern to block encoded XSS payloads in REST URIs
# ModSecurity-style example
SecRule REQUEST_URI "@rx (?i)(%3Cscript|%3Cimg|%3Csvg|onerror%3D|javascript%3A)" \
    "id:1026843801,phase:1,deny,status:403,\
    msg:'Blocked encoded XSS payload targeting AIOS CVE-2026-8438',\
    tag:'CVE-2026-8438'"