All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path

// admin/general/wp-security-ajax-data-table.php line 1319
protected function column_default($item, $column_name) {} 

---

// admin/general/wp-security-ajax-data-table.php lines 1421-1427
// The base table class echoes the return value of column_default without escaping
} else {
    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
    echo "<td $attributes>";
    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
    echo $this->column_default($item, $column_name);
    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
    echo $this->handle_row_actions($item, $column_name, $primary);
    echo '</td>';
}

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/all-in-one-wp-security-and-firewall/5.4.7/admin/general/wp-security-ajax-data-table.php /home/deploy/wp-safety.org/data/plugin-versions/all-in-one-wp-security-and-firewall/5.4.8/admin/general/wp-security-ajax-data-table.php
--- /home/deploy/wp-safety.org/data/plugin-versions/all-in-one-wp-security-and-firewall/5.4.7/admin/general/wp-security-ajax-data-table.php	2026-04-27 22:11:04.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/all-in-one-wp-security-and-firewall/5.4.8/admin/general/wp-security-ajax-data-table.php	2026-06-03 08:12:30.000000000 +0000
@@ -1316,15 +1365,22 @@
 	 * @param array  $item        - Item object
 	 * @param string $column_name - Column name to be rendered from item object
 	 */
-	protected function column_default($item, $column_name) {} // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable, Squiz.WhiteSpace.ScopeClosingBrace.ContentBefore, PEAR.WhiteSpace.ScopeClosingBrace.Line -- this is a protected function
-
+	protected function column_default($item, $column_name) {
+		echo esc_html($item[$column_name]);
+	}
+	
 	/**
 	 * This function renders the checkbox column
 	 *
 	 * @param array $item - item object
 	 */
-	protected function column_cb($item) {} // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable, Squiz.WhiteSpace.ScopeClosingBrace.ContentBefore, PEAR.WhiteSpace.ScopeClosingBrace.Line -- this is a protected function
-
+	protected function column_cb($item) {
+		printf(
+			'<input type="checkbox" name="%1$s[]" value="%2$s" />',
+			esc_attr($this->_args['singular']),  //Let's simply repurpose the table's singular label
+			esc_attr($item['id'])                //The value of the checkbox should be the record's id
+		);
+	}
 
 	/**
 	 * Generates the columns for a single row of the table
@@ -1350,57 +1406,24 @@
 
 			// Comments column uses HTML in the display name with screen reader text.
 			// Instead of using esc_attr(), we strip tags to get closer to a user-friendly string.
-			$data = 'data-colname="' . wp_strip_all_tags($column_display_name) . '"';
+			$data_colname = wp_strip_all_tags($column_display_name);
 
-			$attributes = "class='$classes' $data";
 			if ('cb' === $column_name) {
 				echo '<th scope="row" class="check-column">';
-				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
-				echo $this->column_cb($item);
+				$this->column_cb($item);
 				echo '</th>';
-			} elseif (method_exists($this, '_column_' . $column_name)) {
-				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
-				echo call_user_func(
-					array($this, '_column_' . $column_name),
-					$item,
-					$classes,
-					$data,
-					$primary
-				);
 			} elseif (method_exists($this, 'column_' . $column_name)) {
-				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
-				echo "<td $attributes>";
-				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
-				echo call_user_func(array($this, 'column_' . $column_name), $item);
-				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
-				echo $this->handle_row_actions($item, $column_name, $primary);
+				echo '<td class="'.esc_attr($classes).'" data-colname="'.esc_attr($data_colname).'">';
+				call_user_func(array($this, 'column_' . $column_name), $item);
 				echo '</td>';
 			} else {
-				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
-				echo "<td $attributes>";
-				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
-				echo $this->column_default($item, $column_name);
-				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- PCP Error. Escaped earlier in other functions.
-				echo $this->handle_row_actions($item, $column_name, $primary);
+				echo '<td class="'.esc_attr($classes).'" data-colname="'.esc_attr($data_colname).'">';
+				$this->column_default($item, $column_name);
 				echo '</td>';
 			}
 		}