Quick answers
- Is CVE-2026-6128 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6128 being exploited in the wild.
- How severe is CVE-2026-6128?
- Medium severity, with a CVSS score of 6.4, published 28 August 2026.
- Which products and versions are affected?
- ServMask All-in-One WP Migration Unlimited Extension up to and including 2.84.
- Is there a fix for CVE-2026-6128?
- A patch was published on 2026-06-24: Fixed in version 2.85 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-6128 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-6128?
- Check whether you run ServMask All-in-One WP Migration Unlimited Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the All-in-One WP Migration Unlimited Extension plugin affecting versions up to 2.84. The vulnerability exists in the 'ai1wm_backups_path' parameter within the settings() function due to insufficient input sanitization and output escaping combined with missing authorization checks. An authenticated attacker with Subscriber-level access or above can inject arbitrary JavaScript into the backup path setting, which persists in the database and executes whenever an administrator accesses the plugin settings page. The vulnerability was partially addressed in version 2.84 through a permission fix, with a more comprehensive fix implemented in version 2.85 that directly addressed the stored XSS in the backups path setting.
Affected products
- ServMask All-in-One WP Migration Unlimited Extension up to and including 2.84
Timeline
- 2026-08-28: disclosed
- 2026-06-24: patched: Fixed in version 2.85