CVE-2025-8490

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-84914.3The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.CVE-2025-84925.3The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modi CVE-2025-84939.8A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknow CVE-2025-84949.8A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affec CVE-2025-84959.8A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknow CVE-2025-84969.8A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is an CVE-2025-84979.8A weakness has been identified in code-projects Online Medicine Guide 1.0. This affects an unknown part of the file /cusfindphar2.php. This CVE-2025-84989.8A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /CVE-2025-84999.8A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown c CVE-2025-85008.8A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unkn CVE-2025-85015.4A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown funct CVE-2025-85029.8A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Affected by this vulnerability is an unknown fu