Skip to content
OpenAdvisories

Vendor

servmask

10 known vulnerabilities.

servmask at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 1 vulnerability June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 2 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202620
Jul 202600
Jun 202600
May 202610
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202510
Feb 202500
Jan 202500
Dec 202400

Products

All-in-One WP Migration and Backup 7 All-in-One WP Migration Unlimited Extension 2 All-in-One WP Migration Box Extension 1 All-in-One WP Migration OneDrive Extension 1 All-in-One WP Migration Dropbox Extension 1 All-in-One WP Migration Google Drive Extension 1
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Medium 5.3
    CVE-2026-89064

    All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method — registered on the `admin_init` hook, which fir…

    servmask All-in-One WP Migration and Backup Web / CMS
  • Medium 6.4
    CVE-2026-6128

    All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter

    The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output esca…

    servmask All-in-One WP Migration Unlimited Extension Web / CMS
  • High 8.8
    CVE-2026-19949 Public exploit

    All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara…

    servmask All-in-One WP Migration and Backup Web / CMS
  • Medium 6.5
    CVE-2026-5753

    All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download

    The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not …

    servmask All-in-One WP Migration Unlimited Extension Web / CMS
  • Medium 4.4
    CVE-2025-8490

    All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

    servmask All-in-One WP Migration and Backup Web / CMS
  • High 7.5
    CVE-2024-10942

    All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 via deserialization of untrusted input in the 'replace_serialized_values' function. This makes it possible for unauthe…

    servmask All-in-One WP Migration and Backup Web / CMS
  • High 7.2
    CVE-2024-9162 Public exploit

    All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, wit…

    servmask All-in-One WP Migration and Backup Web / CMS
  • Medium 5.3
    CVE-2024-8852

    All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially…

    servmask All-in-One WP Migration and Backup Web / CMS
  • High 7.3
    CVE-2023-40004 EPSS 11%

    Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins

    Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One WP Migration Dropbox Extension, ServMask All-in-One WP Migration Google Drive Extension.This issue …

    servmask All-in-One WP Migration Dropbox Extension All-in-One WP Migration OneDrive Extension All-in-One WP Migration Google Drive Extension
  • Medium 6.6
    CVE-2022-1476 EPSS 46%

    All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts

    The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploit…

    servmask All-in-One WP Migration and Backup Web / CMS