All-in-One WP Migration, 5f7257e2-d4da-4fb9-a5da-31332c4ec848

CVE, Research URL: 5f7257e2-d4da-4fb9-a5da-31332c4ec848
Home page URL: Security reports for All-in-One WP Migration
Application: All-in-One WP Migration
Published on: -
Research Description: All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.0 All-in-One WP Migration < 7.0 - Authenticated Cross-Site Scripting (XSS) An attacker would already have to be able to either compromise the database or gain access to a user account with high enough privileges to view the backup history, so some damage has already been done, but such an attacker could then also insert some XSS in order to compromise other admin users. When double-clicking the backup description on the backup history overview page, in order to edit the description text, the text is not sanitized/escaped via html entities when generating the input field. This has been reported to the plugin author on 2 July 2019 and confirmed to be fixed in version 7.0 on 17 July 2019.
Affected versions: max 7.0.
Status: vulnerable