The All‑in‑One WP Migration and Backup plugin contains a stored cross‑site scripting vulnerability that allows an authenticated attacker who possesses administrator privileges to inject arbitrary web scripts into the site. The injection occurs during the import process and the malicious code is stored, causing it to execute for any user that visits the affected page. Because the vulnerable code is executed within the context of the user’s browser, it can be used to steal credentials, deface content, or facilitate further attacks on the site’s users.

This issue affects the servmask All‑in‑One WP Migration and Backup plugin in all releases up to and including version 7.97. The vulnerability is limited to multi‑site WordPress installations and to sites where the unfiltered_html feature has been disabled, meaning that ordinary administrators have the necessary permissions to trigger the import routine and thereby place the malicious script into the database.

The CVSS score of 4.4 classifies this as a low‑severity flaw, and the EPSS score of less than 1% indicates a very small likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an account with administrator rights, so an unauthenticated attacker cannot use this vector. Nevertheless, any user who visits the page containing the injected script becomes a victim of the XSS payload, creating a potential cross‑site risk for all site visitors.