Executive brief
The All-in-One WP Migration Unlimited Extension is a WordPress plugin that enables site administrators to back up and migrate WordPress installations. The plugin contains a stored cross-site scripting (XSS) vulnerability in its backup path settings that allows authenticated users with Subscriber access or higher to inject malicious scripts. When an administrator accesses the plugin settings, the injected script executes in their browser session, potentially allowing attackers to steal admin credentials or perform unauthorized administrative actions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the All-in-One WP Migration Unlimited Extension plugin affecting versions up to 2.84. The vulnerability exists in the 'ai1wm_backups_path' parameter within the settings() function due to insufficient input sanitization and output escaping combined with missing authorization checks. An authenticated attacker with Subscriber-level access or above can inject arbitrary JavaScript into the backup path setting, which persists in the database and executes whenever an administrator accesses the plugin settings page. The vulnerability was partially addressed in version 2.84 through a permission fix, with a more comprehensive fix implemented in version 2.85 that directly addressed the stored XSS in the backups path setting.
Affected products
- ServMask All-in-One WP Migration Unlimited Extension up to and including 2.84
Timeline
- 2026-08-28: disclosed
- 2026-06-24: patched: Fixed in version 2.85