Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
285 results · page 5 of 6
Dec 22, 2023Backup Migration: OS Command InjectionCVE-2023-7002 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.
- Product
- Backup Migration
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 22, 2023Backup Migration: Path TraversalCVE-2023-6972 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
- Product
- Backup Migration
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 22, 2023Backup Migration: Remote File InclusionCVE-2023-6971 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.
- Product
- Backup Migration
- Affected
- 1.0.8 to 1.3.9
- What to do
- Affects 1.0.8 to 1.3.9. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 15, 2023Backup Migration: Remote Code ExecutionCVE-2023-6553 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
- Product
- Backup Migration
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 30, 2023Jetpack – WP Security, Backup, Speed, & Growth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-45050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1.
- Product
- Jetpack – WP Security, Backup, Speed, & Growth
- Affected
- up to 12.8-a.1
- What to do
- Affects up to 12.8-a.1. Update Jetpack – WP Security, Backup, Speed, & Growth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 27, 2023WordPress Backup & Migration: Does not sanitise and escape some parametersCVE-2023-5738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
- Product
- WordPress Backup & Migration
- Fixed in
- 1.4.4
- What to do
- Update WordPress Backup & Migration to 1.4.4 or newer.
Nov 27, 2023WordPress Backup & Migration: Does not authorize some AJAX requestsCVE-2023-5737 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.
- Product
- WordPress Backup & Migration
- Fixed in
- 1.4.4
- What to do
- Update WordPress Backup & Migration to 1.4.4 or newer.
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Prashant Walke WP All Backup plugin <= 2.4.3 versions.CVE-2023-32583 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Prashant Walke WP All Backup plugin <= 2.4.3 versions.
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023UpdraftPlus: WordPress Backup & Migration: Cross-Site Request ForgeryCVE-2023-5982 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.
- Product
- UpdraftPlus: WordPress Backup & Migration
- Affected
- up to 1.23.10
- What to do
- Affects up to 1.23.10. Update UpdraftPlus: WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 20, 2023Migration, Backup, Staging – WPvivid: Stored Cross-Site ScriptingCVE-2023-5121 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.89
- What to do
- Affects up to 0.9.89. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 20, 2023Migration, Backup, Staging - WPvivid: Sensitive Information ExposureCVE-2023-5576 · WordPress plugins & themes · reported by WordfenceHigh 8
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering.
- Product
- Migration, Backup, Staging - WPvivid
- Affected
- up to 0.9.91
- What to do
- Affects up to 0.9.91. Update Migration, Backup, Staging - WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023Migration, Backup, Staging – WPvivid: Stored Cross-Site ScriptingCVE-2023-5120 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.89
- What to do
- Affects up to 0.9.89. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 20, 2023Migration, Backup, Staging – WPvivid: Directory TraversalCVE-2023-4274 · WordPress plugins & themes · reported by WordfenceHigh 8.7
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server, which can be a critical issue in a shared environments.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.89
- What to do
- Affects up to 0.9.89. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide CrossCVE-2023-32960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).
- Affected
- up to 1.23.3
- What to do
- Affects up to 1.23.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 15, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin CVE-2022-34148 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.
- Affected
- up to 1.6.9.0
- What to do
- Affects up to 1.6.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023BackupBuddy: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2022-31474 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.
- Product
- BackupBuddy
- Affected
- up to 8.7.4.1
- What to do
- Affects up to 8.7.4.1. Update BackupBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordithemes.compatchstack.com
Mar 7, 2023BackupWordPress: Information disclosureCVE-2022-4931 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
- Product
- BackupWordPress
- Affected
- up to 3.12
- What to do
- Affects up to 3.12. Update BackupWordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Cross-Site Request ForgeryCVE-2020-36669 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary files to the vulnerable site's server via a forged request, granted they can trick a site's administrator into performing an action such as clicking on a link.
- Product
- JetBackup – WP Backup, Migrate & Restore
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Sensitive information disclosureCVE-2020-36668 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.
- Product
- JetBackup – WP Backup, Migrate & Restore
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Unauthorized back-up location changesCVE-2020-36667 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to change to location of back-ups and potentially steal sensitive information from them.
- Product
- JetBackup – WP Backup, Migrate & Restore
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2023BackupBuddy: Does not sanitise and escape some parameters before outputting them back in various placesCVE-2022-4897 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
- Product
- BackupBuddy
- Fixed in
- 8.8.3
- What to do
- Update BackupBuddy to 8.8.3 or newer.
Nov 28, 2022Download: Does not properly validate a user has the required privileges to access a backup's nonce identifierCVE-2021-25059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
- Product
- Download
- Fixed in
- 2.0.0
- What to do
- Update Download to 2.0.0 or newer.
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress.CVE-2022-38079 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress.
- Affected
- up to 1.5.13
- What to do
- Affects up to 1.5.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 16, 2022Migration, Backup, Staging: Does not sanitise and validate a parameter before using it to read the content of a fileCVE-2022-2863 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.76
- What to do
- Update Migration, Backup, Staging to 0.9.76 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 6, 2022Migration, Backup, Staging – WPvivid: Deserialization of untrusted inputCVE-2022-2442 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.74
- What to do
- Affects up to 0.9.74. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2022WP Database Backup: Does not escape some of its settingsCVE-2022-2271 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Database Backup
- Fixed in
- 5.9
- What to do
- Update WP Database Backup to 5.9 or newer.
Aug 22, 2022Duplicator: Discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the pluginCVE-2022-2551 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
- Product
- Duplicator
- Fixed in
- 1.4.7
- What to do
- Update Duplicator to 1.4.7 or newer.
Aug 1, 2022Project Source Code Download: Does not protect its backup generation and download functionalitiesCVE-2022-1585 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
- Product
- Project Source Code Download
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Project Source Code Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- WordPress Security Firewall, Malware Scanner, Secure Login and Backup
- Fixed in
- 4.2.1
- What to do
- Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.
Jun 27, 2022Backup, Restore and Migrate WordPress Sites With the XCloner: Does not have authorisation and CSRF checksCVE-2022-0444 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
- Product
- Backup, Restore and Migrate WordPress Sites With the XCloner
- Fixed in
- 4.3.6
- What to do
- Update Backup, Restore and Migrate WordPress Sites With the XCloner to 4.3.6 or newer.
Jun 13, 2022Keep Backup Daily: Reflected Cross-Site ScriptingCVE-2022-1820 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Keep Backup Daily
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 8, 2022Database Backup for: Does not have CSRF check in placeCVE-2022-1577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
- Product
- Database Backup for
- Fixed in
- 2.5.2
- What to do
- Update Database Backup for to 2.5.2 or newer.
Apr 11, 2022WPvivid Team Migration, Backup, Staging – WPvivid: Arbitrary File ReadCVE-2022-27844 · WordPress plugins & themes · reported by PatchstackLow 2.7
Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70
- Product
- WPvivid Team Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.70
- What to do
- Affects up to 0.9.70. Update WPvivid Team Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Migration, Backup, Staging: Does not sanitise and escape the sub_page parameter before outputting it back in the pageCVE-2022-0531 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.70
- What to do
- Update Migration, Backup, Staging to 0.9.70 or newer.
Apr 11, 2022settings of the iQ Block Country: Can be exported or imported using its backup functionalityCVE-2022-0246 · WordPress plugins & themes · reported by WPScanMedium 4.9
The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
- Product
- settings of the iQ Block Country
- Fixed in
- 1.2.13
- What to do
- Update settings of the iQ Block Country to 1.2.13 or newer.
Apr 4, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_interval parameter before outputting it back in an admin pageCVE-2022-0864 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.22.9
- What to do
- Update UpdraftPlus WordPress Backup to 1.22.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Feb 28, 2022Migration, Backup, Staging: Does not have authorisationCVE-2021-24994 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.69
- What to do
- Update Migration, Backup, Staging to 0.9.69 or newer.
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
- Product
- Database Backup for
- Fixed in
- 2.5.1
- What to do
- Update Database Backup for to 2.5.1 or newer.
Feb 17, 2022The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nCVE-2022-0633 · WordPress plugins & themes · reported by WPScanMedium 6.5
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
- Fixed in
- 1.22.3
- What to do
- Update the plugin to 1.22.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comjetpack.com
Feb 1, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore pageCVE-2021-25089 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page, leading to a Reflected Cross-Site Scripting
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.16.69
- What to do
- Update UpdraftPlus WordPress Backup to 1.16.69 or newer.
Jan 24, 2022Backup and Staging by WP Time Capsule: Does not sanitise and escape the error parameter before outputting it back in an admin pageCVE-2021-25035 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Backup and Staging by WP Time Capsule
- Fixed in
- 1.22.7
- What to do
- Update Backup and Staging by WP Time Capsule to 1.22.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022UpdraftPlus WordPress Backup: Does not sanitise its updraft_service settingsCVE-2021-24423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.6.59
- What to do
- Update UpdraftPlus WordPress Backup to 1.6.59 or newer.
Jan 3, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pagesCVE-2021-25022 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.16.66
- What to do
- Update UpdraftPlus WordPress Backup to 1.16.66 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2021WP Data Access: Does not properly sanitise and escape the backup_date parameter before using it a SQL statementCVE-2021-24866 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
- Product
- WP Data Access
- Fixed in
- 5.0.0
- What to do
- Update WP Data Access to 5.0.0 or newer.
Nov 19, 2021Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.CVE-2021-36884 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 12, 2021Backup by 10Web – Backup and Restore: Does not sanitise or escape the tab parameter before outputting it back in the pageCVE-2021-24426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
- Product
- Backup by 10Web – Backup and Restore
- Affected
- up to 1.0.20
- What to do
- Affects up to 1.0.20. Update Backup by 10Web – Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2021Database Backup for: Did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tagCVE-2021-24322 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
- Product
- Database Backup for
- Fixed in
- 2.4
- What to do
- Update Database Backup for to 2.4 or newer.
Apr 5, 2021Database Backups: Does not have CSRF checksCVE-2021-24174 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
- Product
- Database Backups
- Affected
- up to 1.2.2.6
- What to do
- Affects up to 1.2.2.6. Update Database Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 5, 2021VM Backups: Does not have CSRF checksCVE-2021-24173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue.
- Product
- VM Backups
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update VM Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021VM Backups: Does not have CSRF checksCVE-2021-24172 · WordPress plugins & themes · reported by WPScanMedium 4.3
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current .
- Product
- VM Backups
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update VM Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.