Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-94175

WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Published
Last modified
published
Not listed in CISA KEV
Specific setups only
Fix
Fixed in 2.5.0
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  4. Record last updated

Affected versions

  • change-wp-admin-login

    through 2.4.1

References 1

patchstack.com

FAQ

Questions about CVE-2026-94175

What does this mean?

The plugin fails to sanitize some input, so an attacker can inject malicious scripts into pages of the site. Those scripts can steal visitor data or hijack user accounts.Source: patchstack.com

Am I affected, and how do I check?

WordPress All In One Login plugin versions 2.4.1 and earlier are affected. To check, look at the plugin version shown on the Plugins screen of the WordPress admin dashboard.Source: patchstack.com

What should I do about it?

Update the All In One Login plugin to version 2.5.0 or later, which contains the fix.Source: patchstack.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data