CVE-2022-2546: Servmask All-In-One Wp Migration

Medium severity, CVSS 4.7. EPSS: 1.2% chance of exploitation in the next 30 days.

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key

Affected products

• Servmask All-In-One Wp Migration: before 7.63 (fixed in 7.63)

Published 2023-02-02. Last modified 2026-06-17.