CVE-2022-2546

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	All-in-One WP Migration	< 7.63

References

https://wpscan.com/vulnerability/f84920e4-a1fe-47cf-9ba5-731989c70f58Exploit, Third Party Advisory
https://wpscan.com/vulnerability/f84920e4-a1fe-47cf-9ba5-731989c70f58Exploit, Third Party Advisory

Timeline

Published: Feb 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-254609.8Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the endip parameter in the SetPptpServerCfg function.CVE-2022-254619.8Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the startip parameter in the SetPptpServerCfg function.CVE-2022-254627.5Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c. This vulnerability allows attackers to cause a Denia CVE-2022-254644.8A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrar CVE-2022-254657.8Espruino 2v11 release was discovered to contain a stack buffer overflow via src/jsvar.c in jsvGetNextSibling.CVE-2022-25477.5A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22.CVE-2022-254718.1An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorize CVE-2022-254775.5Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read CVE-2022-254787.8Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read CVE-2022-254795.5Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read CVE-2022-254807.8Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read CVE-2022-254817.5ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system enviro