{"id":"CVE-2026-94175","title":"WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability","summary":"Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Saad Iqbal","product":"change-wp-admin-login","affected":["change-wp-admin-login >= n/a <= 2.4.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T18:46:09.658651Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T19:00:18.724Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-94175","references":[{"url":"https://patchstack.com/database/wordpress/plugin/change-wp-admin-login/vulnerability/wordpress-all-in-one-login-plugin-2-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"tags":["cve.org"],"epss":0.00184,"epssPercentile":0.08036,"ingestedAt":"2026-11-05T16:24:31.397Z","slug":"CVE-2026-94175","body":"## Overview\n\nUnauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.\n\n## Affected\n\n- `change-wp-admin-login >= n/a <= 2.4.1`\n\n## Remediation\n\nUpdate to 2.5.0 or a higher version.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}