# CVE-2026-94175: All In One Login cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-94175-unauthenticated-cross-site-scripting-xss-in-all-in-one-login-2-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-94175 · Severity: high · CVSS 7.1 · Published 2026-10-30

All In One Login is a WordPress plugin that provides custom login functionality for websites. The plugin contains an unauthenticated cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts, which can steal visitor data or hijack user accounts. An attacker can exploit this flaw without needing login credentials, though successful exploitation requires user interaction such as clicking a malicious link.

Vendors: [WPExperts](https://junglewise.ai/threats/vendors/wpexperts).

## Quick answers

**Is CVE-2026-94175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94175 being exploited in the wild.

**How severe is CVE-2026-94175?** High severity, with a CVSS score of 7.1, published 30 October 2026.

**Which products and versions are affected?** WPExperts All In One Login 2.4.1 and earlier.

**Is there a fix for CVE-2026-94175?** Yes: fixed in 2.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94175 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94175?** Check whether you run WPExperts All In One Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5.0

## Technical details

An unauthenticated cross-site scripting vulnerability exists in All In One Login versions 2.4.1 and earlier. The flaw allows attackers to inject malicious JavaScript that executes in the context of a victim's browser session, enabling data theft or session hijacking. User interaction is required to trigger the attack, such as visiting a crafted URL or clicking a malicious link.

## Affected products

- WPExperts All In One Login 2.4.1 and earlier

## Timeline

- 2026-10-30: disclosed
- 2026-10-30: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/change-wp-admin-login/vulnerability/wordpress-all-in-one-login-plugin-2-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/change-wp-admin-login/vulnerability/wordpress-all-in-one-login-plugin-2-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve)