CVE-2022-2546

Deeper analysis

The All-in-One WP Migration WordPress plugin before version 7.63 is affected by an improper output handling issue in the ai1wm_export AJAX action. The plugin uses an incorrect content type and fails to escape the server response, enabling injection of arbitrary HTML or JavaScript that executes in the context of a visitor's session. Exploitation requires knowledge of a static secret key and carries a CVSS 4.7 rating reflecting network attack vector, high complexity, no privileges, and required user interaction.

An attacker who knows the secret key can craft a malicious request to the AJAX endpoint. When any site visitor submits or triggers that request, the injected script runs in the visitor's browser session, allowing limited impacts such as data theft or session manipulation within the affected page context.

The referenced WPScan advisory at https://wpscan.com/vulnerability/f84920e4-a1fe-47cf-9ba5-731989c70f58 identifies the flaw and notes the fixed version.

EPSS for this CVE rose from a low baseline to a peak of 0.5455 on 2025-12-11 before receding to the current value of 0.1621, indicating a period of increased exploitation interest after disclosure.