CVE-2025-8490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8490", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-01T21:37:26.217Z", "datePublished": "2025-08-26T23:22:40.976Z", "dateUpdated": "2026-04-08T17:04:37.782Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:37.782Z"}, "affected": [{"vendor": "servmask", "product": "All-in-One WP Migration and Backup", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.97", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/85930893-d415-4131-bcda-54a20644eddc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.97/lib/controller/class-ai1wm-import-controller.php#L144"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jack Pas"}], "timeline": [{"time": "2025-07-25T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-08-02T01:44:28.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-26T10:28:31.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-27T19:44:13.841317Z", "id": "CVE-2025-8490", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-27T19:44:20.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8490", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-27T19:44:13.841317Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-27T19:44:18.243Z"}}], "cna": {"title": "All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import", "credits": [{"lang": "en", "type": "finder", "value": "Jack Pas"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "servmask", "product": "All-in-One WP Migration and Backup", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.97"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-25T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-08-02T01:44:28.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-26T10:28:31.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/85930893-d415-4131-bcda-54a20644eddc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.97/lib/controller/class-ai1wm-import-controller.php#L144"}], "descriptions": [{"lang": "en", "value": "The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:37.782Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8490", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:04:37.782Z", "dateReserved": "2025-08-01T21:37:26.217Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-26T23:22:40.976Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "All-in-One WP Migration and Backup", "vendor": "servmask", "versions": [{"lessThanOrEqual": "7.97", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El complemento All-in-One WP Migration and Backup para WordPress es vulnerable a cross-site scripting almacenado mediante la importaci\u00f3n en todas las versiones hasta la 7.97 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de administrador, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-8490", "lastModified": "2026-06-17T10:07:04.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8490", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-27T19:44:13.841317Z", "version": "2.0.3"}}]}, "published": "2025-08-27T00:15:40.917", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.97/lib/controller/class-ai1wm-import-controller.php#L144"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/85930893-d415-4131-bcda-54a20644eddc?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:14:59.092993+00:00", "value": {"mitigation_remediation": ["Update the All\u2011in\u2011One WP Migration and Backup plugin to the latest version (7.98 or newer) where the import handler has been fixed.", "Restrict the import functionality to super administrators only to minimize the number of users who can trigger the vulnerable routine.", "Verify that the unfiltered_html capability is disabled in all relevant sites to prevent unintended script execution.", "If a patch cannot be applied immediately, consider disabling the import feature via plugin settings or by removing the associated PHP files from the server to block further exploitation."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting via Import"}, "threat_synthesis": {"affected_systems": "This issue affects the servmask All\u2011in\u2011One WP Migration and Backup plugin in all releases up to and including version 7.97. The vulnerability is limited to multi\u2011site WordPress installations and to sites where the unfiltered_html feature has been disabled, meaning that ordinary administrators have the necessary permissions to trigger the import routine and thereby place the malicious script into the database.", "description_and_impact": "The All\u2011in\u2011One WP Migration and Backup plugin contains a stored cross\u2011site scripting vulnerability that allows an authenticated attacker who possesses administrator privileges to inject arbitrary web scripts into the site. The injection occurs during the import process and the malicious code is stored, causing it to execute for any user that visits the affected page. Because the vulnerable code is executed within the context of the user\u2019s browser, it can be used to steal credentials, deface content, or facilitate further attacks on the site\u2019s users.", "risk_and_exploitability": "The CVSS score of 4.4 classifies this as a low\u2011severity flaw, and the EPSS score of less than 1% indicates a very small likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an account with administrator rights, so an unauthenticated attacker cannot use this vector. Nevertheless, any user who visits the page containing the injected script becomes a victim of the XSS payload, creating a potential cross\u2011site risk for all site visitors."}}}}, "created": "2025-08-27T11:21:22.922302+00:00", "updated": "2026-04-21T19:15:26.041562+00:00", "vendors": ["servmask", "servmask$PRODUCT$all-in-one_wp_migration", "wordpress", "wordpress$PRODUCT$wordpress"]}