CVE-2026-6128

MediumCVSS 6.4

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to and including 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This allows authenticated attackers with Subscriber-level access or above to inject arbitrary web scripts that execute when an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84.

Risk Assessment

The risk involves potential execution of malicious scripts in the context of an administrator session, which could lead to account takeover, data theft, or further compromise of the WordPress site.

Recommendation

Immediately update the plugin to the latest available version that includes the full fix. Additionally, restrict user privileges to the minimum and regularly audit roles.

Other vulnerabilities in All-in-One WP Migration Unlimited Extension

CVE-2026-5753Medium
The All-in-One WP Migration Unlimited Extension plugin for WordPress up to version 2.83 lacks authorization checks when saving schedule data. Authenticated attackers with subscriber-level access can create scheduled exports and send backup filenames to attacker-controlled emails, enabling full site backup download.

Original NVD description (English source)

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84.