Description (CNA)
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / All-in-One WP Migration | affected 0 before 7.63 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.