CVE-2026-6128

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration Unlimited Extension versions prior to 2.85

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied attributes, combined with missing authorization checks in the settings() function. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts via the ai1wm backups path parameter. These scripts execute when an administrator accesses the plugin settings page.

Recommendations Update All-in-One WP Migration Unlimited Extension to version 2.85 or later.