CVE-2023-0157

Deeper analysis

The All-In-One Security (AIOS) WordPress plugin before version 5.1.5 contains a stored cross-site scripting flaw (CVE-2023-0157, CWE-79) in its log-file handling. The plugin fails to escape log contents before rendering them on the administrative interface, allowing malicious JavaScript to persist and execute when an administrator views the affected page. The issue carries a CVSS 4.8 rating reflecting network attack vector, high privileges required, and the need for user interaction.

An authenticated administrator can deliberately plant crafted log files containing script payloads. When another administrator accesses the plugin’s log viewer, the payload executes in that administrator’s browser context, enabling actions such as account manipulation or further plugin configuration changes within the WordPress site.

Public references from WPScan identify the vulnerability and indicate that updating to AIOS 5.1.5 or later resolves the improper output encoding.

EPSS scores for the CVE rose from a low baseline to a peak of 0.4316 before settling at the current value of 0.2513, indicating measurable post-disclosure exploitation interest that warrants renewed attention.