Servmask vulnerabilities

Products

• All-in-one Wp Migration And Backup 10
• All-in-one Wp Migration 4
• All-in-one Wp Migration Unlimited Extension 2

Newest

• servmask all-in-one wp migration and backup All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure CVE-2026-81810 7.2 HighSeptember 18, 2026
• servmask all-in-one wp migration and backup All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header CVE-2026-89064 5.3 MediumSeptember 17, 2026
• servmask all-in-one wp migration unlimited extension All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter CVE-2026-6128 6.4 MediumAugust 28, 2026
• servmask all-in-one wp migration and backup All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution CVE-2026-19949 Public exploit 8.8 HighAugust 25, 2026
• servmask all-in-one wp migration and backup All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import CVE-2026-17533 7.2 HighAugust 16, 2026
• servmask all-in-one wp migration and backup All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal CVE-2026-12898 6.5 MediumJuly 20, 2026
• servmask all-in-one wp migration unlimited extension All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download CVE-2026-5753 6.5 MediumMay 6, 2026
• servmask all-in-one wp migration and backup All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import CVE-2025-8490 4.4 MediumAugust 26, 2025
• servmask all-in-one wp migration and backup All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection CVE-2024-10942 7.5 HighMarch 13, 2025
• servmask all-in-one wp migration and backup, yaniiliev all in one wp migration and backup +1 more All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection CVE-2024-9162 Public exploit 7.2 HighOctober 28, 2024
• servmask all-in-one wp migration and backup, all-in-one wp migration +1 more All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs CVE-2024-8852 5.3 MediumOctober 22, 2024
• servmask all-in-one wp migration box extension, all-in-one wp migration dropbox extension, all-in-one wp migration google drive extension +2 more +4 more Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins CVE-2023-40004 EPSS 11.0% 7.3 HighJune 19, 2024
• servmask all-in-one wp migration All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS CVE-2022-2546 Public exploit 4.7 MediumFebruary 2, 2023
• servmask all-in-one wp migration, all-in-one wp migration and backup +1 more All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts CVE-2022-1476 EPSS 46.3% 6.6 MediumMay 10, 2022
• unknown all-in-one wp migration, servmask one-stop wp migration +1 more All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE CVE-2021-24216 7.2 HighMarch 7, 2022