EUVD-2026-67648
GHSA-vh38-jq6h-xh79
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Changed UI:N to UI:R because payload only executes when an administrator explicitly visits the settings page post-injection, constituting required user interaction.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84.
AnalysisAI
Stored cross-site scripting in All-in-One WP Migration Unlimited Extension (all versions up to and including 2.84) allows any authenticated WordPress user with Subscriber-level access to plant persistent JavaScript payloads via the ai1wm_backups_path parameter, which execute in the administrator's browser context when the plugin settings page is visited. Two compounding weaknesses drive the flaw: absent input sanitization on the parameter and missing authorization checks on the settings() function, permitting low-privileged users to write attacker-controlled data into plugin configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must run All-in-One WP Migration Unlimited Extension version 2.84 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) rates this as Medium severity, with the scope-changed designation (S:C) reflecting cross-privilege escalation from subscriber to administrator context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (partial); released fully patched version not independently confirmed - version 2.84 represents only a partial remediation, and no complete fix version number has been specified in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today