Skip to content
OpenAdvisories

Vendor

wpvividplugins

22 known vulnerabilities.

Products

WPvivid — Backup, Migration & Staging 16 WPvivid Backup for MainWP 3 Migration, Backup, Staging – WPvivid 2 WPvivid Backup and Migration 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.2
    CVE-2025-5961 Public exploit EPSS 55%

    Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload

    The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This make…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • High 7.2
    CVE-2024-13869 Public exploit

    Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file

    The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible f…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • High 8.8
    CVE-2024-10962

    Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection

    The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replace_row_data' and 'replace_serialize_data' functions. This mak…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • High 8.8
    CVE-2020-36842 Public exploit

    Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload

    The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to u…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • High 7.1
    CVE-2024-35664

    WordPress WPvivid Backup for MainWP plugin <= 0.9.32 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpvividplugins WPvivid Backup for MainWP wpvivid-backup-mainwp allows Reflected XSS.This issue affects WPvivid Backup for MainWP: from n/a through <= 0.9.32.

    wpvividplugins WPvivid Backup for MainWP
  • High 7.2
    CVE-2024-3054 EPSS 42%

    WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization

    WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not prov…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • High 8.7
    CVE-2023-4274

    The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, a…

    wpvividplugins Migration, Backup, Staging – WPvivid Web / CMS
  • High 8.0
    CVE-2023-5576

    Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure

    The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow una…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • High 7.2
    CVE-2022-2442

    Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization

    The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileg…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS