Servmask develops WordPress migration and backup plugins, with its exposure centered on the All-In-One WP Migration product line, a widely deployed tool for site transfers and data management. The recurring vulnerability patterns involve sensitive-data exposure, path-traversal conditions, and unrestricted file uploads—weaknesses characteristic of plugins managing file operations and administrative access controls in the WordPress ecosystem. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Servmask over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-1476MEDIUM The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1w | May 10, 2022 | 6.5 | 47 | NO | NO |
CVE-2022-2546MEDIUM The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attac | Feb 2, 2023 | 4.7 | 28 | NO | YES |
CVE-2024-8852MEDIUM The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log | Oct 22, 2024 | 5.3 | 26 | NO | YES |
CVE-2021-24216HIGH The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisi | Mar 7, 2022 | 7.2 | 25 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Servmask.
Media articles that mention a CVE ID that affects a product developed by Servmask — matched by CVE ID, not by vendor name.