Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

34 results

Oct 16, 2026Backuply – Backup, Restore, Migrate and Clone: SQL InjectionCVE-2026-93953 · WordPress plugins & themes · reported by WordfenceHigh 8
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database reco
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.CVE-2026-42419 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.CVE-2026-42413 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.CVE-2026-84778 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.
Affected
up to 6.65
What to do
Affects up to 6.65. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.CVE-2026-54839 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.CVE-2026-49043 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Enable jQuery Migrate Helper: Unauthorized modification of dataCVE-2026-3279 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `downgrade_jquery_version()` function in all versions up to, and including, 1.4.1. This is due to the function only verifying a nonce without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to downgrade the site-wide jQuery version from 3.7.1 to the legacy 1.12.4-wp release, which has knowns security vulnerabilities.
Product
Enable jQuery Migrate Helper
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Enable jQuery Migrate Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 1, 2026Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Unauthorized modification of dataCVE-2026-3143 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, 1.17.1. This makes it possible for unauthenticated attackers to cancel a pending rollback, potentially preventing a WordPress installation from automatically reverting a failed update.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2026JetBackup – Backup, Restore & Migrate: Path Traversal leading to Arbitrary Directory DeletionCVE-2026-4853 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This is due to insufficient input validation on the fileName parameter in the file upload handler. The plugin sanitizes the fileName parameter using sanitize_text_field(), which removes HTML tags but does not prevent path traversal sequences like '../'. The unsanitized filename is then directly concatenated in Upload::getFileLocation() without using basename() or validating the resolved path stays within the intended directory. When an invalid file is uploaded, the cleanup logic calls dirname() on the traversed path and passes it to Util::rm(), which recursively deletes the entire resolved directory. This makes it possible for authenticated attackers with administrator-level access to traverse outside the intended upload directory and trigger deletion of critical WordPress directories such as wp-content/plugins, effectively disabling all installed plugins and causing severe site disruption.
Product
JetBackup – Backup, Restore & Migrate
Affected
up to 3.1.19.8
What to do
Affects up to 3.1.19.8. Update JetBackup – Backup, Restore & Migrate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 4, 2025Backup, Restore and Migrate your sites with XCloner: Cross-Site Request ForgeryCVE-2025-11759 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.2. This is due to missing or incorrect nonce validation on the Xcloner_Remote_Storage:save() function. This makes it possible for unauthenticated attackers to add or modify an FTP backup configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows an attacker to set an attacker-controlled FTP site for backup storage and exfiltrate potentially sensitive site data.
Product
Backup, Restore and Migrate your sites with XCloner
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update Backup, Restore and Migrate your sites with XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 18, 2025WP Migrate Lite – WordPress Migration Made Easy: Blind Server-Side Request ForgeryCVE-2025-11427 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services.
Product
WP Migrate Lite – WordPress Migration Made Easy
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update WP Migrate Lite – WordPress Migration Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025Backuply – Backup, Restore, Migrate and Clone: Arbitrary file deletionCVE-2025-10307 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Sensitive Information ExposureCVE-2020-36848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.14.9
What to do
Affects up to 1.14.9. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org raw.githubusercontent.com
Mar 26, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Remote Code ExecutionCVE-2025-2257 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.16.10
What to do
Affects up to 1.16.10. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.svn.wordpress.org
Mar 3, 2025Migrate Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected XSS.This issue affects Migrate Posts: from n/a through <= 1.0.
Product
Migrate Posts
Affected
up to 1.0
What to do
Affects up to 1.0. Update Migrate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 27, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Server-Side Request ForgeryCVE-2024-13907 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.16.8
What to do
Affects up to 1.16.8. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025W2S – Migrate WooCommerce to Shopify: Arbitrary File ReadCVE-2024-12861 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_view_log' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
W2S – Migrate WooCommerce to Shopify
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update W2S – Migrate WooCommerce to Shopify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025CMC MIGRATE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through <= 0.0.3.
Product
CMC MIGRATE
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update CMC MIGRATE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Super Backup & Clone - Migrate for: Arbitrary file uploadsCVE-2024-9290 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Super Backup & Clone - Migrate for
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Super Backup & Clone - Migrate for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 26, 2024Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Remote Code ExecutionCVE-2024-9461 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.16.6
What to do
Affects up to 1.16.6. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 14, 2024Backuply – Backup, Restore, Migrate and Clone: SQL InjectionCVE-2024-8669 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to the backuply_wp_clone_sql() function in all versions up to, and including, 1.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2024Backup, Restore and Migrate WordPress Sites With the XCloner: Full Path DisclosureCVE-2024-6559 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Backup, Restore and Migrate WordPress Sites With the XCloner
Affected
up to 4.7.3
What to do
Affects up to 4.7.3. Update Backup, Restore and Migrate WordPress Sites With the XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 28, 2024WP Migrate: Deserialization of Untrusted DataCVE-2024-30225 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10.
Product
WP Migrate
Affected
up to 2.6.10
What to do
Affects up to 2.6.10. Update WP Migrate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Backuply – Backup, Restore, Migrate and Clone: Directory TraversalCVE-2024-2294 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backup_name parameter in the backuply_download_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to access arbitrary files on the server, which can contain sensitive information. This only impacts sites hosted on Windows servers.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 9, 2024Backuply – Backup, Restore, Migrate and Clone: Denial of ServiceCVE-2024-0842 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 1.2.6. This is due to direct access of the backuply/restore_ins.php file and. This makes it possible for unauthenticated attackers to make excessive requests that result in the server running out of resources.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2024Backuply – Backup, Restore, Migrate and Clone: Directory TraversalCVE-2024-0697 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the node_id parameter in the backuply_get_jstree function. This makes it possible for attackers with administrator privileges or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2024Migrate WordPress Website & Backups: Does not prevent directory listing in sensitive directories containing export filesCVE-2023-6505 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.
Product
Migrate WordPress Website & Backups
Fixed in
1.9.3
What to do
Update Migrate WordPress Website & Backups to 1.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 15, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin CVE-2022-34148 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.
Affected
up to 1.6.9.0
What to do
Affects up to 1.6.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Cross-Site Request ForgeryCVE-2020-36669 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary files to the vulnerable site's server via a forged request, granted they can trick a site's administrator into performing an action such as clicking on a link.
Product
JetBackup – WP Backup, Migrate & Restore
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Sensitive information disclosureCVE-2020-36668 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.
Product
JetBackup – WP Backup, Migrate & Restore
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Unauthorized back-up location changesCVE-2020-36667 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to change to location of back-ups and potentially steal sensitive information from them.
Product
JetBackup – WP Backup, Migrate & Restore
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 27, 2022Backup, Restore and Migrate WordPress Sites With the XCloner: Does not have authorisation and CSRF checksCVE-2022-0444 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
Product
Backup, Restore and Migrate WordPress Sites With the XCloner
Fixed in
4.3.6
What to do
Update Backup, Restore and Migrate WordPress Sites With the XCloner to 4.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021Migrate Users: Does not sanitise or escape its Delimiter option before outputting in a pageCVE-2021-24477 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.
Product
Migrate Users
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Migrate Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021WordPress Backup and Migrate Plugin – Backup Guard: Did not ensure that the imported files are of the SGBP format and extensionCVE-2021-24155 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
Product
WordPress Backup and Migrate Plugin – Backup Guard
Fixed in
1.6.0
What to do
Update WordPress Backup and Migrate Plugin – Backup Guard to 1.6.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.