All-in-One WP Migration, 32801aa2696918ba7e359dfa86b5fe0ed5a42c22

CVE, Research URL: 32801aa2696918ba7e359dfa86b5fe0ed5a42c22
Home page URL: Security reports for All-in-One WP Migration
Application: All-in-One WP Migration
Published on: Jun 20, 2017
Research Description: All-in-One WP Migration and Backup [all-in-one-wp-migration] < 6.46 All-in-One WP Migration <= 6.45 - Reflected Cross-Site Scripting The All-in-One WP Migration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘secret_key’ parameter in versions up to, and including, 6.45 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 6.46.
Status: vulnerable