77 matches found
CVE-2022-2546
All-in-One WP Migration 영향을 받는 버전 All-in-One WP Migration 7.63 참고 자료 Sucuri WPScan Hacking Force 사이트 간 스크립팅 XSS 분류 유형: 크로스 사이트 스크립팅 XSS OWASP TOP 10: A03:2021-Injection CWE: CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 연구원/해커 Geovanni Campos GeoZIN,...
CVE-2024-9162
CVE-2024-9162 All-in-One WP Migration and Backup SELECT optionname,optionvalue FROM wpoptions WHERE optionname='ai1wmsecretkey'; +------------------+--------------+ | optionname | optionvalue | +------------------+--------------+ | ai1wmsecretkey | PwrqqK3UHQJo | +------------------+-------------...
All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...
WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting
WordPress All-in-One WP Migration plugin 7.62 and prior contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials a...
WordPress All-in-One WP Migration Unlimited Extension plugin <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via 'ai1wmbackupspath' Parameter vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin All-in-One WP Migration Unlimited Extension versions = 2.84...
CVE-2026-6128
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
EUVD-2026-67648
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
CVE-2026-6128
The All-in-One WP Migration Unlimited Extension WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the ai1wm_backups_path parameter in all versions up to and including 2.84 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes, co...
CVE-2026-6128 All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
PT-2026-83073
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm backups path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes...
WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability
Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...
CVE-2026-19949
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
EUVD-2026-65463
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-19949
The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....
PT-2026-81268
Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.110 Description The archive restore functionality contains a SQL Injection flaw caused by insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries. This...
CVE-2026-17533
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...
EUVD-2026-59911
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...
CVE-2026-17533 All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...
CVE-2026-17533
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...