Description

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-28T12:16:30.990Z",
  "pubdate": "2026-08-28T12:16:30.990Z",
  "executiveSummary": "The All-in-One WP Migration Unlimited Extension plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 2.84.\nThis vulnerability originates from insufficient input sanitization and output escaping, coupled with an absence of proper authorization checks within the plugin's settings management functionality.\nSuccessful exploitation allows an authenticated attacker possessing Subscriber-level privileges or higher to inject arbitrary malicious scripts into the application environment.\nThe malicious payload is stored within the plugin settings and executes within the context of an administrator's browser session when they access the plugin's configuration page.\nThis vulnerability poses a significant security risk, as it allows for unauthorized actions, session hijacking, or administrative account compromise through cross-site scripting attacks.\nExploitation is contingent upon the attacker maintaining an authenticated session on the target WordPress instance, thereby limiting the scope of the threat to authorized or registered users of the platform.",
  "technicalDetails": "The vulnerability resides within the settings() function of the All-in-One WP Migration Unlimited Extension plugin, specifically involving the processing of the 'ai1wm_backups_path' parameter.\nThe root cause is identified as a failure to implement adequate input sanitization and output escaping protocols on user-supplied data transmitted to this parameter. Furthermore, the function lacks mandatory authorization checks, permitting users with lower privilege levels—specifically Subscribers—to interact with settings that should be restricted to administrative roles.\nThe attack flow proceeds as follows: An authenticated attacker submits a crafted HTTP request containing malicious JavaScript payloads injected into the 'ai1wm_backups_path' field. Due to the lack of validation, the plugin accepts the malicious input and persists it directly into the WordPress database.\nThe payload remains dormant within the storage mechanism until a privileged user, such as a site administrator, navigates to the plugin settings page. Upon rendering the settings page, the plugin retrieves the compromised 'ai1wm_backups_path' value and reflects it into the HTML document without appropriate context-aware output encoding.\nConsequently, the browser interprets the injected script as legitimate code belonging to the site, leading to immediate execution. Because this occurs within the administrator's authenticated session, the script operates with full administrative privileges within the victim's browser environment.\nThe post-exploitation impact includes the potential for unauthorized administrative configuration changes, the creation of rogue administrative accounts, sensitive data exfiltration (such as session tokens or nonces), and the redirection of the administrator to malicious domains. The vulnerability underscores the critical necessity for strict input validation, consistent output encoding via WordPress-native functions such as esc_html() or esc_attr(), and the rigorous enforcement of capability checks (e.g., current_user_can('manage_options')) for all administrative functions. Although version 2.84 included a partial patch, the persistence of the issue in this version indicates that the implementation of security controls remains incomplete or insufficient to fully remediate the flaw, necessitating further hardening of the data flow pipeline for settings management."
}