All-in-One WP Security & Firewall (AIOS) is a popular security plugin with over 1 million active installations. In June 2026, a critical unauthenticated stored cross-site scripting (XSS) vulnerability was disclosed in versions 5.4.7 and earlier. If you’re running an older version, attackers can inject malicious JavaScript that persists on your site and executes in visitors’ browsers.
What’s the vulnerability?
CVE-2026-8438 is a stored XSS flaw that allows unauthenticated attackers to inject JavaScript code into your WordPress database. Unlike reflected XSS, which requires a user to click a malicious link, stored XSS persists. Every visitor to your site will execute the attacker’s code in their browser.
The vulnerability has a CVSS score of 7.1 (moderate) but is actively being exploited in mass-attack campaigns. Attackers are targeting thousands of WordPress sites simultaneously, regardless of traffic or popularity.
What can an attacker do?
Once injected, the malicious code runs with the same privileges as your site. An attacker could:
- Steal admin session cookies and gain access to your WordPress dashboard
- Inject fake login forms to harvest credentials
- Redirect visitors to malicious sites or inject malware
- Create hidden admin accounts for persistent access
- Deface your site’s content
- Inject hidden links to manipulate search engine rankings
The code executes in every visitor’s browser, making it difficult to detect without checking your site’s HTML source or database directly.
How do I check if I’m affected?
First, check your AIOS version. Log into your WordPress admin panel, navigate to Plugins, and look for All-in-One WP Security & Firewall. If the version is 5.4.7 or earlier, you’re vulnerable.
If you’re concerned about existing injections, check your database for suspicious entries. You can use WP-CLI:
wp db query "SELECT * FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%javascript:%';"
wp db query "SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%javascript:%';"Also check your WordPress options table for injected code in serialised plugin settings.
What should I do?
Update immediately. The fix is in version 5.4.8 and later. Log into your WordPress admin, go to Plugins, and click Update next to All-in-One WP Security & Firewall.
After updating:
- Run a full security scan using Wordfence or Sucuri to check for backdoors or malware
- Review your admin users list for any unauthorised accounts
- Check your database for injected scripts (use the WP-CLI commands above)
- Review your access logs for suspicious requests during the vulnerability window
- Consider changing all admin passwords as a precaution
If you can’t update immediately, disable the plugin temporarily until you can apply the patch. The plugin’s security features are less important than preventing active exploitation.
Why does this matter?
Security plugins are supposed to protect your site, not introduce vulnerabilities. AIOS has a good reputation, but this flaw shows why keeping plugins updated is non-negotiable. Attackers actively scan for known vulnerabilities and exploit them at scale.
If you’re managing multiple WordPress sites, automated vulnerability monitoring catches these disclosures before they become a problem. Tools like Vulnz track WordPress plugin vulnerabilities and alert you when patches are released.
Summary
Update All-in-One WP Security & Firewall to 5.4.8 or later immediately. Check your database for injected code, audit your admin users, and review your access logs. If you’re running an older version, assume you’ve been targeted by mass-exploit campaigns and take the precautions above seriously.
Questions? Let me know.