CVE-2026-94175

HighCVSS 7.1

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

The All In One Login WordPress plugin in versions up to 2.4.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability.

An unauthenticated attacker could inject a malicious script that executes in a user's browser, potentially leading to session or data theft.

Update the All In One Login plugin to a version newer than 2.4.1 or disable it if no update is available.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS