The All‑In‑One Security (AIOS) plugin for WordPress contains a stored Cross‑Site Scripting flaw in its REST API request handling. When debug logging is enabled and the REST API is blocked for unauthenticated users, an attacker can transmit malicious HTML or JavaScript encoded in the request path. The path is decoded and inserted without sanitization into a debug log entry, which is then displayed in the Dashboard Debug Logs page without escaping. This permits arbitrary script execution in the administrator’s browser, enabling nonce theft, privileged AJAX or REST actions and potentially full site compromise. The weakness is a classic input validation and output escaping failure, corresponding to CWE‑79.

All‑In‑One Security (AIOS) – Security and Firewall plugin version 5.4.7 and earlier is affected. Users running this plugin on any WordPress installation should verify the plugin version and update if necessary.

The impact score is 7.2 on the CVSS scale, indicating a high‑severity vulnerability. EPSS data is not available, so the likely exploitation probability cannot be quantified, but the vulnerability demands attention. The issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack path requires an attacker to craft a specially encoded REST request that bypasses the REST API restriction and embeds malicious content into a debug log. An unauthenticated attacker can then lure an administrator to the debug log page to trigger the XSS payload.