Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?JetBackupWPvividbackup-backupEverest BackupXClonerWP Database BackupAll-in-One WP Migration and BackupBackup and Staging by
Plugin · backup
JetBackup
11 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 22, 2026JetBackup: Symlink-based arbitrary file writeCVE-2026-104068 · fixed in 3.1.24.10 · reported by VulnCheckHigh 8.6
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
Sep 2, 2026JetBackup: Does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privilegesCVE-2026-19453 · fixed in 3.1.23.5 · reported by WPScanHigh 7.1
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
Aug 27, 2026JetBackup: Does not perform its multisite authorisation check before serving backup archives and job logsCVE-2026-19454 · fixed in 3.1.23.5 · reported by WPScanMedium 4.4
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Apr 17, 2026JetBackup – Backup, Restore & Migrate: Path Traversal leading to Arbitrary Directory DeletionCVE-2026-4853 · affects up to 3.1.19.8 · reported by WordfenceMedium 4.9
The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This is due to insufficient input validation on the fileName parameter in the file upload handler. The plugin sanitizes the fileName parameter using sanitize_text_field(), which removes HTML tags but does not prevent path traversal sequences like '../'. The unsanitized filename is then directly concatenated in Upload::getFileLocation() without using basename() or validating the resolved path stays within the intended directory. When an invalid file is uploaded, the cleanup logic calls dirname() on the traversed path and passes it to Util::rm(), which recursively deletes the entire resolved directory. This makes it possible for authenticated attackers with administrator-level access to traverse outside the intended upload directory and trigger deletion of critical WordPress directories such as wp-content/plugins, effectively disabling all installed plugins and causing severe site disruption.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 27, 2024JetBackup: Doesn't use index files to prevent public directory listing of sensitive directories in certain configurationsCVE-2023-7165 · fixed in 2.0.9.9 · reported by WPScanHigh 7.5
The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.
Mar 15, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin CVE-2022-34148 · affects up to 1.6.9.0 · reported by PatchstackMedium 4.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Cross-Site Request ForgeryCVE-2020-36669 · affects up to 1.3.9 · reported by WordfenceHigh 8.8
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary files to the vulnerable site's server via a forged request, granted they can trick a site's administrator into performing an action such as clicking on a link.
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Sensitive information disclosureCVE-2020-36668 · affects up to 1.4.0 · reported by WordfenceMedium 4.3
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Unauthorized back-up location changesCVE-2020-36667 · affects up to 1.4.1 · reported by WordfenceMedium 5.4
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to change to location of back-ups and potentially steal sensitive information from them.
Aug 13, 2019The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.CVE-2017-18488 · fixed in 1.1.47 · reported by MITREMedium 6.1
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
Aug 28, 2017BackupGuard prior to version 1.1.47: Cross-site scriptingCVE-2017-10837 · affects up to 1.1.46 · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.