CVE-2026-8438 describes a stored cross-site scripting vulnerability in the All-In-One Security (AIOS) – Security and Firewall plugin for WordPress, affecting versions up to 5.4.7. The vulnerability arises from insufficient input sanitization in the get_rest_route() function and lack of output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' and debug logging features are both enabled, an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. This path is decoded and stored unsanitized in the debug log database. When an administrator views the debug logs, the raw stored data is output without escaping, causing script execution in the administrator's session. This can lead to nonce theft, unauthorized privileged actions, and potential full site compromise.

An unauthenticated attacker can inject malicious scripts that execute in the context of an administrator's browser session upon viewing the debug logs. This can result in theft of security tokens (nonces), execution of privileged AJAX or REST API actions, and potentially full compromise of the WordPress site. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), indicating significant risk if exploited.

No official patch or fix is currently confirmed for this vulnerability. Administrators should check the vendor advisory for updates. Until a fix is available, consider disabling the 'Disable REST API for non-logged in users' feature or debug logging to reduce exposure. Avoid viewing debug logs in untrusted environments. Monitor vendor channels for official patches or updates.