All In One Login CVE-2026-94175

Exploitation requires an attacker to deliver a crafted request/URL to the vulnerable All In One Login plugin (versions <= 2.4.1) and have a victim interact with it (UI:R) - typically by clicking a malicious link or loading an attacker-supplied page - since this is reflected XSS rather than stored. No authentication is required to craft the request (PR:N), but the dependency on victim interaction and the need for the WordPress site to be running this specific plugin at an affected version are the primary limiting factors. The exact vulnerable parameter, endpoint, and whether any non-default plugin configuration is required are not described in the available sources.

Signals are mixed and lean toward a moderate, not critical, priority. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) reflects a reflected cross-site scripting flaw: network-reachable, low complexity, no authentication, but requiring victim interaction (UI:R) and yielding only low confidentiality/integrity/availability impact with a scope change into the browser context. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact fields were supplied, so quantitative exploitation likelihood cannot be stated. There is no public exploit identified at time of analysis; the sole reference is a Patchstack database entry, not working exploit code. The vuln.today decision label is 'this_week', indicating elevated-but-not-emergency urgency consistent with an unauthenticated XSS in a WordPress plugin. The UI:R requirement (a victim must be induced to click a crafted link or load a crafted request) is the main factor limiting real-world impact, keeping this below the tier of a server-side unauthenticated RCE despite the 'unauthenticated' label. Treat as a real but second-tier priority to patch within the week, not a drop-everything emergency.

An attacker crafts a malicious URL or request targeting the All In One Login plugin (<= 2.4.1) and lures a logged-in administrator or visitor into clicking it; the unsanitized input is reflected back and executes attacker-controlled JavaScript in the victim's browser session. This could be used to hijack session tokens, perform actions as the victim, or deface the rendered page. No public exploit code is identified at time of analysis, and the specific injection trigger is not described in the available sources.