CVE-2022-2546 is a Cross-Site Scripting (XSS) vulnerability affecting the All-in-One WP Migration WordPress plugin prior to version 7.63. An attacker can inject arbitrary HTML or JavaScript into a victim's session by crafting a specific request to the ai1wm_export AJAX action. This medium-severity vulnerability (CVSS 4.7) requires knowledge of a static secret key, increasing attack complexity, but could lead to limited confidentiality and integrity impacts. There is no evidence of active exploitation, and while Nuclei templates exist, there are no Metasploit modules or ExploitDB entries, and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.63CPE matchmatch criteria | cpe:2.3:a:servmask:all-in-one_wp_migration:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.