Skip to content
OpenAdvisories

Vendor

servmask

10 known vulnerabilities.

Products

All-in-One WP Migration and Backup 7 All-in-One WP Migration Unlimited Extension 2 All-in-One WP Migration Box Extension 1 All-in-One WP Migration OneDrive Extension 1 All-in-One WP Migration Dropbox Extension 1 All-in-One WP Migration Google Drive Extension 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-89064

    All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method — registered on the `admin_init` hook, which fir…

    servmask All-in-One WP Migration and Backup Web / CMS
  • Medium 6.4
    CVE-2026-6128

    All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter

    The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output esca…

    servmask All-in-One WP Migration Unlimited Extension Web / CMS
  • Medium 6.5
    CVE-2026-5753

    All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download

    The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not …

    servmask All-in-One WP Migration Unlimited Extension Web / CMS
  • Medium 4.4
    CVE-2025-8490

    All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

    servmask All-in-One WP Migration and Backup Web / CMS
  • Medium 5.3
    CVE-2024-8852

    All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially…

    servmask All-in-One WP Migration and Backup Web / CMS
  • Medium 6.6
    CVE-2022-1476 EPSS 46%

    All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts

    The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploit…

    servmask All-in-One WP Migration and Backup Web / CMS