Is my WordPress plugin safe?

• Aug 31, 2026Keep Backup Daily: Sensitive information exposureCVE-2026-75133 · fixed in 2.1.4 · reported by VulnCheckHigh 8.7

  Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current Unix timestamp to download the generated backup from the publicly accessible uploads directory.

  NVD recordwordpress.orgvulncheck.com

• Mar 20, 2026Keep Backup Daily: Stored Cross-Site ScriptingCVE-2026-3577 · affects up to 2.1.2 · reported by WordfenceMedium 4.4

  The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (`val` parameter) in the `update_kbd_bkup_alias` AJAX action in all versions up to, and including, 2.1.2. This is due to insufficient input sanitization and output escaping. While `sanitize_text_field()` strips HTML tags on save, it does not encode double quotes. The backup titles are output in HTML attribute contexts without `esc_attr()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via attribute injection that will execute whenever another administrator views the backup list page.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 20, 2026Keep Backup Daily: Limited Path TraversalCVE-2026-3339 · affects up to 2.1.1 · reported by WordfenceLow 2.7

  The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 16, 2025Keep Backup Daily: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26779 · affects up to 2.1.0 · reported by PatchstackMedium 4.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path Traversal.This issue affects Keep Backup Daily: from n/a through <= 2.1.0.

  NVD recordpatchstack.com

• Oct 17, 2024Keep Backup Daily: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-48024 · affects up to 2.1.3 · reported by PatchstackHigh 7.5

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Retrieve Embedded Sensitive Data.This issue affects Keep Backup Daily: from n/a through <= 2.1.3.

  NVD recordpatchstack.com

• Jun 13, 2022Keep Backup Daily: Reflected Cross-Site ScriptingCVE-2022-1820 · affects up to 2.0.2 · reported by WordfenceMedium 6.1

  The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  NVD recordplugins.trac.wordpress.orgwordpress.org

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.