CVE-2026-6128: All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
All-in-One WP Migration Unlimited Extensionto a version that resolves this vulnerability.Fixed in 2.84 - Configuration
Update the plugin so that the 'ai1wm_backups_path' parameter is properly sanitized and output-escaped in the plugin's settings page, and ensure the settings() function performs required authorization checks (not accessible to Subscriber+ without admin-level permission).
All-in-One WP Migration Unlimited Extension settings() function input handling for ai1wm_backups_path = Sanitize input and escape output; add authorization checks
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need administrator privileges, but an administrator must later open the plugin settings page for the injected script to execute.
Are sites running version 2.84 affected?
Yes. The issue affects all versions up to and including 2.84; version 2.84 contains only a partial patch.
What is the impact if exploitation succeeds?
An attacker can store arbitrary web script through the ai1wm_backups_path parameter. That script executes in an administrator's browser when the administrator accesses the plugin settings page, potentially exposing information or enabling actions with that administrator's session.