The All-in-One WP Migration and Backup plugin for WordPress contains a stored XSS vulnerability (CWE-79) in versions up to 7.97. This vulnerability is due to improper neutralization of input during web page generation, specifically in the import functionality. Authenticated attackers with administrator privileges can inject arbitrary web scripts that persist and execute when other users access the affected pages. This issue only impacts multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and a scope change with low confidentiality and integrity impact and no availability impact.

Successful exploitation allows an authenticated administrator to inject persistent malicious scripts into the plugin's import process, potentially leading to unauthorized script execution in the context of affected users. This can result in limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by the victim user. The vulnerability does not affect availability. It is limited to multi-site or restricted HTML capability environments and requires administrator-level privileges, reducing the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or limiting the use of the import functionality in multi-site or restricted HTML environments. Monitor vendor communications for updates on patches or official mitigations.