CVE-2026-6128: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in servmask All-in-One WP Migration Unlimited Extension

CVE-2026-6128 is a stored cross-site scripting vulnerability in the All-in-One WP Migration Unlimited Extension WordPress plugin. It affects all versions up to and including 2.84. The flaw is due to improper neutralization of user input in the 'ai1wm_backups_path' parameter combined with missing authorization checks in the settings() function. This allows authenticated attackers with Subscriber-level privileges or higher to inject arbitrary web scripts that execute when an administrator accesses the plugin's settings page. The vulnerability was partially addressed in version 2.84, but no full remediation status is confirmed.

An attacker with Subscriber-level access or higher can inject and store malicious scripts that execute in the context of an administrator's browser when they visit the plugin settings page. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed with administrator privileges. There is no indication of availability impact. The CVSS score is 6.4 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Version 2.84 includes a partial patch, but no official full fix or remediation level is confirmed. Until a full patch is available, restrict access to the plugin settings page to trusted administrators only and monitor for suspicious activity related to this plugin.