{"id":"CVE-2022-2546","aliases":["EUVD-2022-34800","GHSA-qfjr-7vg6-v99x"],"status":"published","title":"All-in-One WP Migration \u003c 7.63 - Unauthenticated Reflected XSS","description":"The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01204,"percentile":0.68482,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2023-02-02T08:28:46Z","modified":"2026-06-17T04:42:05Z","exploits":[{"source":"nuclei","id":"CVE-2022-2546","title":"WordPress All-in-One WP Migration \u003c=7.62 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2546.yaml"},{"source":"pocgithub","id":"OpenXP-Research/CVE-2022-2546","title":"OpenXP-Research/CVE-2022-2546","date":"2024-09-19","url":"https://github.com/OpenXP-Research/CVE-2022-2546"}],"products":[{"vendor":"servmask","product":"all-in-one_wp_migration"},{"vendor":"unknown","product":"all-in-one wp migration"}],"references":[{"url":"https://wpscan.com/vulnerability/f84920e4-a1fe-47cf-9ba5-731989c70f58","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2546"},{"url":"https://github.com/advisories/GHSA-qfjr-7vg6-v99x"}],"sources":{"cve":[{"id":"CVE-2022-2546","title":"All-in-One WP Migration \u003c 7.63 - Unauthenticated Reflected XSS","description":"The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key","status":"published","published":"2023-02-02T08:28:46.865Z","modified":"2025-03-26T14:24:03.385Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-34800","description":"The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key","status":"published","published":"2023-02-02T08:28:46Z","modified":"2025-03-26T14:24:03Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:51.751114Z"}],"ghsa":[{"id":"GHSA-qfjr-7vg6-v99x","title":"The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does...","description":"The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key","status":"published","published":"2023-02-02T09:30:27Z","modified":"2023-02-17T05:05:51Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:08.612342Z"}],"nvd":[{"id":"CVE-2022-2546","description":"The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key","status":"published","published":"2023-02-02T09:15:08.403Z","modified":"2026-06-17T04:42:05.79Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:36.026349Z"}]}}