Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

40 results

Oct 16, 2026Backuply – Backup, Restore, Migrate and Clone: SQL InjectionCVE-2026-93953 · WordPress plugins & themes · reported by WordfenceHigh 8
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database reco
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.CVE-2026-54839 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.CVE-2026-48965 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.
Affected
up to 4.8.6
What to do
Affects up to 4.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Page and Post Clone: SQL InjectionCVE-2026-2893 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to, and including, 6.3. This is due to insufficient escaping on the user-supplied meta_key value and insufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious payload is stored as a post meta key and executed when the post is cloned.
Product
Page and Post Clone
Affected
up to 6.3
What to do
Affects up to 6.3. Update Page and Post Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2025Post Cloner: Missing AuthorizationCVE-2025-62865 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Evan Herman Post Cloner post-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Cloner: from n/a through <= 1.0.0.
Product
Post Cloner
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Post Cloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 4, 2025Backup, Restore and Migrate your sites with XCloner: Cross-Site Request ForgeryCVE-2025-11759 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.2. This is due to missing or incorrect nonce validation on the Xcloner_Remote_Storage:save() function. This makes it possible for unauthenticated attackers to add or modify an FTP backup configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows an attacker to set an attacker-controlled FTP site for backup storage and exfiltrate potentially sensitive site data.
Product
Backup, Restore and Migrate your sites with XCloner
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update Backup, Restore and Migrate your sites with XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025MultiSite Clone Duplicator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Globalis MultiSite Clone Duplicator multisite-clone-duplicator allows Reflected XSS.This issue affects MultiSite Clone Duplicator: from n/a through <= 1.5.3.
Product
MultiSite Clone Duplicator
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update MultiSite Clone Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Backuply – Backup, Restore, Migrate and Clone: Arbitrary file deletionCVE-2025-10307 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2025WP Clone any post type: Missing AuthorizationCVE-2025-31872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Clone any post type: from n/a through <= 3.6.
Product
WP Clone any post type
Affected
up to 3.6
What to do
Affects up to 3.6. Update WP Clone any post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP Clone any post type: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-31871 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Phishing.This issue affects WP Clone any post type: from n/a through <= 3.6.
Product
WP Clone any post type
Affected
up to 3.6
What to do
Affects up to 3.6. Update WP Clone any post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 22, 2025Code Clone: Time-based SQL InjectionCVE-2025-2478 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Code Clone plugin for WordPress is vulnerable to time-based SQL Injection via the ‘snippetId’ parameter in all versions up to, and including, 0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Code Clone
Affected
up to 0.9
What to do
Affects up to 0.9. Update Code Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 3, 2025Content Cloner: Missing AuthorizationCVE-2025-22681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xfinitysoft Content Cloner super-seo-content-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Cloner: from n/a through <= 1.0.1.
Product
Content Cloner
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Content Cloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Super Backup & Clone - Migrate for: Arbitrary file uploadsCVE-2024-9290 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Super Backup & Clone - Migrate for
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Super Backup & Clone - Migrate for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Dec 9, 2024Clone: Missing AuthorizationCVE-2023-25486 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.3.7.
Product
Clone
Affected
up to 2.3.7
What to do
Affects up to 2.3.7. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 20, 2024Clone: PHP Object InjectionCVE-2024-10913 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Clone
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2024Clone: Missing AuthorizationCVE-2024-43298 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.
Product
Clone
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Clone: Missing AuthorizationCVE-2024-43297 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.
Product
Clone
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 14, 2024Backuply – Backup, Restore, Migrate and Clone: SQL InjectionCVE-2024-8669 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to the backuply_wp_clone_sql() function in all versions up to, and including, 1.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2024Backup, Restore and Migrate WordPress Sites With the XCloner: Full Path DisclosureCVE-2024-6559 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Backup, Restore and Migrate WordPress Sites With the XCloner
Affected
up to 4.7.3
What to do
Affects up to 4.7.3. Update Backup, Restore and Migrate WordPress Sites With the XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 29, 2024Page and Post Clone: Insecure Direct Object ReferenceCVE-2024-5942 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts.
Product
Page and Post Clone
Affected
up to 6.0
What to do
Affects up to 6.0. Update Page and Post Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2024WP Clone Menu: Missing AuthorizationCVE-2023-38395 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Afzal Multani WP Clone Menu.This issue affects WP Clone Menu: from n/a through 1.0.1.
Product
WP Clone Menu
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Clone Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024WP Page Post Widget Clone: Missing AuthorizationCVE-2024-33636 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mahesh Vora WP Page Post Widget Clone.This issue affects WP Page Post Widget Clone: from n/a through 1.0.1.
Product
WP Page Post Widget Clone
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Page Post Widget Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Backuply – Backup, Restore, Migrate and Clone: Directory TraversalCVE-2024-2294 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backup_name parameter in the backuply_download_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to access arbitrary files on the server, which can contain sensitive information. This only impacts sites hosted on Windows servers.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 9, 2024Backuply – Backup, Restore, Migrate and Clone: Denial of ServiceCVE-2024-0842 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 1.2.6. This is due to direct access of the backuply/restore_ins.php file and. This makes it possible for unauthenticated attackers to make excessive requests that result in the server running out of resources.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2024Backuply – Backup, Restore, Migrate and Clone: Directory TraversalCVE-2024-0697 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the node_id parameter in the backuply_get_jstree function. This makes it possible for attackers with administrator privileges or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2024Clone: Uses buffer files to store in-progress backup informationsCVE-2023-6750 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.
Product
Clone
Fixed in
2.4.3
What to do
Update Clone to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Backup, Restore and Migrate WordPress Sites With the XCloner: Does not have authorisation and CSRF checksCVE-2022-0444 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
Product
Backup, Restore and Migrate WordPress Sites With the XCloner
Fixed in
4.3.6
What to do
Update Backup, Restore and Migrate WordPress Sites With the XCloner to 4.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022WP Post Page Clone: Allows users with a roleCVE-2021-24733 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and password-protected posts which they cannot view normally.
Product
WP Post Page Clone
Fixed in
1.2
What to do
Update WP Post Page Clone to 1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 31, 2020An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress.CVE-2020-35950 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint).
Product
An issue was discovered in the XCloner Backup and Restore
Fixed in
4.2.153
What to do
Update An issue was discovered in the XCloner Backup and Restore to 4.2.153 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Dec 31, 2020An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress.CVE-2020-35948 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.
Product
An issue was discovered in the XCloner Backup and Restore
Fixed in
4.2.13
What to do
Update An issue was discovered in the XCloner Backup and Restore to 4.2.13 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 17, 2015Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language fCVE-2015-4338 · WordPress plugins & themes · reported by MITREMedium 6.5
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via CVE-2015-4337 · WordPress plugins & themes · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 17, 2015cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames wCVE-2015-4336 · WordPress plugins & themes · reported by MITREMedium 6.5
cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.
Product
XCloner
Affected
3.1.2 to 3.1.2
What to do
Affects 3.1.2 to 3.1.2. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain seCVE-2014-8607 · WordPress plugins & themes · reported by MITRELow 2.1
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a ..CVE-2014-8606 · WordPress plugins & themes · reported by MITREMedium 4
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.
Product
XCloner
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access conCVE-2014-8605 · WordPress plugins & themes · reported by MITREMedium 5
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/.
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remoCVE-2014-8604 · WordPress plugins & themes · reported by MITREMedium 5
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors.
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Jun 10, 2015cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacCVE-2014-8603 · WordPress plugins & themes · reported by MITREMedium 6.5
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable.
Product
XCloner
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapid.dhs.org vapid.dhs.org
Apr 25, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administCVE-2014-2579 · WordPress plugins & themes · reported by MITREHigh 7.6
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands.
Product
generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner
Affected
up to 3.5
What to do
Affects up to 3.5. Update generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Apr 3, 2014Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of adminisCVE-2014-2340 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.
Product
Cross-site request forgery (CSRF) vulnerability in the XCloner
Fixed in
3.1.1
What to do
Update Cross-site request forgery (CSRF) vulnerability in the XCloner to 3.1.1 or newer.
Full record and what to do →NVD record secunia.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.