All-In-One Security (AIOS) – Security and Firewall, CVE-2023-0157

CVE, Research URL: CVE-2023-0157
Home page URL: Security reports for All-In-One Security (AIOS) – Security and Firewall
Application: All-In-One Security (AIOS) – Security and Firewall
Published on: Apr 10, 2023
Research Description: The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
Affected versions: Min -, max 5.2.5.
Status: vulnerable