Live › vulnerability › CVE-2026-94175
All In One Login is a WordPress plugin, and versions up to and including 2.4.1 have a cross-site scripting flaw reachable without logging in. An attacker can get script to run in a visitor's browser on the affected site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the All In One Login WordPress plugin at version 2.4.1 or earlier are exposed, since the flaw needs no account. Sites without this plugin, or with a newer version once the sources confirm one, can skip it. unknown for anything beyond the stated version range.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-94175")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.