CVE-2022-2546
All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS
Vexday Risk Score
28Bajo
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
CVSS 4.7EPSS 1.2%KEV nãoPoC —Nuclei simMetasploit —Patch —
Ciclo de vida
02 feb 2023Publicada en NVD
Recomendación: Planificar corrección próxima — ya existe PoC pública.
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Unknown · All-in-One WP Migration¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →