Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2026-8438

7.2 · HIGH
Published Jun 6, 2026 CWE-79 EPSS 0.49% (40th pctl)

Overview

CVE-2026-8438 is a high-severity vulnerability. It was published on June 6, 2026 and has a CVSS 3.1 base score of 7.2 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.2, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical Description

The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoe

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Ref plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/admin/wp-security-list-debug.php#L43 Ref plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-debug-logger.php#L81 Ref plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-general-init-tasks.php#L887 Ref plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-utility.php#L1547 Ref plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-debug.php#L43 Ref plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-debug-logger.php#L81 Ref plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php#L887 Ref plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-utility.php#L1547 Ref plugins.trac.wordpress.org/changeset/3558989/ Ref www.wordfence.com/threat-intel/vulnerabilities/id/d2b7ed73-a654-40ef-8d80-6171393da8e7?source=cve

Frequently Asked Questions

What is CVE-2026-8438?

CVE-2026-8438 is a high-severity vulnerability. It was published on June 6, 2026 and has a CVSS 3.1 base score of 7.2 (HIGH).

How severe is CVE-2026-8438?

This vulnerability has a CVSS 3.1 base score of 7.2, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2026-8438?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-8438?

CyberStrike's AI-powered security agents can automatically detect CVE-2026-8438 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.
Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.
Code Review

AI-driven PR review catches vulnerable dependencies before they ship.
HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related HIGH CVEs from 2026

View all →
8.9
CVE-2026-23527

H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there

8.9
CVE-2026-24772

OpenProject is an open-source, web-based project management software. To enable the real time collab

8.9
CVE-2026-27169

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative

8.9
CVE-2026-25737

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0

8.9
CVE-2026-30934

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-st

8.9
CVE-2026-31889

Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopwa

8.9
CVE-2026-39328

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting

8.9
CVE-2025-40899

A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due

8.9
CVE-2026-40487

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypa

8.9
CVE-2026-5921

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that a

8.9
CVE-2026-38949

Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation funct

8.9
CVE-2026-5787

An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 a

Browse by year 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2004 2003 2002 2001 2000 1999