CVE-2025-3951 | Medium | 4.1 | 2025-06-02 | The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the a… |
CVE-2024-1037 | Medium | 6.1 | 2024-02-07 | The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all vers… |
CVE-2023-5982 | Medium | 5.4 | 2023-11-07 | The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2… |
CVE-2023-26530 | High | 7.1 | 2023-08-17 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paul Kehrer Updraft plugin <= 0.6.1 versions. |
CVE-2023-1119 | Medium | 6.1 | 2023-07-10 | The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML ch… |
CVE-2023-32960 | High | 7.1 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cros… |
CVE-2023-0157 | Medium | 4.8 | 2023-04-10 | The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing a… |
CVE-2023-0156 | Medium | 4.9 | 2023-04-10 | The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admi… |
CVE-2022-4346 | Medium | 5.3 | 2023-01-23 | The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address. |
CVE-2022-4097 | Medium | 5.3 | 2022-12-12 | The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP block… |
CVE-2022-0864 | Medium | 6.1 | 2022-04-04 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in… |
CVE-2022-0633 | Medium | 6.5 | 2022-02-17 | The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's… |
CVE-2021-25089 | Medium | 6.1 | 2022-02-01 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in… |
CVE-2021-24423 | Medium | 4.8 | 2022-01-24 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set mal… |
CVE-2021-25022 | Medium | 6.1 | 2022-01-03 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputtin… |
CVE-2017-18593 | Medium | 6.1 | 2019-08-28 | The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file. |
CVE-2015-9360 | Medium | 6.1 | 2019-08-28 | The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2017-16871 | High | 8.1 | 2017-11-17 | The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/a… |
CVE-2017-16870 | High | 8.1 | 2017-11-17 | The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget… |