Stored Cross-Site Scripting Vulnerability in All-in-One WP Migration and Backup Plugin for WordPress

CVE-2025-8490

What is CVE-2025-8490?

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the Import functionality. This vulnerability can be exploited by authenticated attackers with administrator-level access, enabling them to inject arbitrary web scripts into pages. The malicious scripts execute whenever a user visits an affected page. This issue is especially pertinent to multi-site installations and sites with unfiltered_html disabled, making it crucial for administrators to ensure their installations are updated and secured against potential exploits.

References