CVE-2022-2546
Medium
Description
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key
SeverityMedium
CVSS4.7
Exploit probability—
ProductServmask All-in-one Wp Migration
PublishedFeb 2, 2023
First seenFeb 2, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- servmask all-in-one_wp_migration7.63 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| servmask all-in-one_wp_migration | v < 7.63 | 7.63 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.