+ 30 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2024-3054
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.100 |
Deserialización de datos no confiables |
Alta
7,2
|
< 0.9.100
|
0.9.100 |
2024-04-11 |
✓ corregido en la última versión
|
|
CVE-2024-1982
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.69 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Crítica
9,1
|
< 0.9.69
|
0.9.69 |
2024-02-28 |
✓ corregido en la última versión
|
|
CVE-2024-1981
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.69 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Crítica
9,1
|
< 0.9.69
|
0.9.69 |
2024-02-28 |
✓ corregido en la última versión
|
|
CVE-2023-4637
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.95 |
Falta de control de autorización |
Media
5,3
|
< 0.9.95
|
0.9.95 |
2024-01-19 |
✓ corregido en la última versión
|
|
CVE-2023-5576
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.92 |
Exposición de información sensible a un actor no autorizado |
Crítica
9,3
|
< 0.9.92
|
0.9.92 |
2023-10-13 |
✓ corregido en la última versión
|
|
CVE-2023-5121
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.90 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 0.9.90
|
0.9.90 |
2023-09-22 |
✓ corregido en la última versión
|
|
CVE-2023-4274
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.90 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Media
6,5
|
< 0.9.90
|
0.9.90 |
2023-09-22 |
✓ corregido en la última versión
|
|
CVE-2023-5120
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.90 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 0.9.90
|
0.9.90 |
2023-09-22 |
✓ corregido en la última versión
|
|
CVE-2023-41243
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.91 |
Gestión incorrecta de privilegios |
Alta
8,8
|
< 0.9.91
|
0.9.91 |
2023-09-13 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.91 |
— |
Desconocido
|
< 0.9.91
|
0.9.91 |
2023-09-13 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.91 |
— |
Desconocido
|
< 0.9.91
|
0.9.91 |
2023-09-12 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.77 |
— |
Desconocido
|
< 0.9.77
|
0.9.77 |
2022-08-29 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.77 |
— |
Desconocido
|
< 0.9.77
|
0.9.77 |
2022-08-29 |
✓ corregido en la última versión
|
|
CVE-2022-2863
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.76 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Media
4,9
|
< 0.9.76
|
0.9.76 |
2022-08-22 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.76 |
— |
Desconocido
|
< 0.9.76
|
0.9.76 |
2022-08-16 |
✓ corregido en la última versión
|
|
CVE-2022-2442
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.76 |
Deserialización de datos no confiables |
Alta
7,2
|
< 0.9.76
|
0.9.76 |
2022-08-10 |
✓ corregido en la última versión
|
|
CVE-2022-27844
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.71 |
Exposición de información sensible a un actor no autorizado |
Baja
2,7
|
< 0.9.71
|
0.9.71 |
2022-04-07 |
✓ corregido en la última versión
|
|
CVE-2022-0531
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.70 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 0.9.70
|
0.9.70 |
2022-03-21 |
✓ corregido en la última versión
|
|
CVE-2021-24994
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.71 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 0.9.71
|
0.9.71 |
2022-01-31 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.56 |
— |
Desconocido
|
< 0.9.56
|
0.9.56 |
2021-08-09 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.53 |
— |
Desconocido
|
< 0.9.53
|
0.9.53 |
2021-04-26 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.36 |
— |
Desconocido
|
< 0.9.36
|
0.9.36 |
2020-03-23 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.36 |
— |
Desconocido
|
< 0.9.36
|
0.9.36 |
2020-03-13 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.36 |
— |
Desconocido
|
< 0.9.36
|
0.9.36 |
2020-02-28 |
✓ corregido en la última versión
|
|
CVE-2025-5961
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.117 |
Carga de archivos sin restricción de tipo peligroso |
Alta
7,2
|
< 0.9.117
|
0.9.117 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2026-1357
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.124 |
— |
Desconocido
|
< 0.9.124
|
0.9.124 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.56 |
— |
Desconocido
|
< 0.9.56
|
0.9.56 |
— |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.77 |
— |
Desconocido
|
< 0.9.77
|
0.9.77 |
— |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.36 |
— |
Desconocido
|
< 0.9.36
|
0.9.36 |
— |
✓ corregido en la última versión
|
|
—
|
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.91 |
— |
Desconocido
|
< 0.9.91
|
0.9.91 |
— |
✓ corregido en la última versión
|
CVE-2024-3054
WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-1982
Update the WordPress WPvivid Backup and Migration plugin to the latest available version (at least 0.9.69).
Denis Werner discovered and reported this Broken Access Control vulnerability in WordPress WPvivid Backup and Migration Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 0.9.69.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-1981
Update the WordPress WPvivid Backup and Migration plugin to the latest available version (at least 0.9.69).
Denis Werner discovered and reported this SQL Injection vulnerability in WordPress WPvivid Backup and Migration Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 0.9.69.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-4637
Update the WordPress WPvivid Backup and Migration plugin to the latest available version (at least 0.9.95).
Revan Arifio discovered and reported this Broken Access Control vulnerability in WordPress WPvivid Backup and Migration Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 0.9.95.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-5576
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2023-5121
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2023-4274
Update the WordPress WPvivid Backup and Migration plugin to the latest available version (at least 0.9.90).
Ivan Kuzymchak discovered and reported this Arbitrary File Deletion vulnerability in WordPress WPvivid Backup and Migration Plugin. This could allow a malicious actor to delete files from your website. If core files are deleted from your website, it could cause your site to break and stop functioning. This vulnerability has been fixed in version 0.9.90.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-5120
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2023-41243
The WPvivid Backup Plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_staging' and 'get_staging_progress' functions in versions up to, and including, 0.9.90. This makes it possible for authenticated attackers to create new staging sites and fresh WordPress installations on the server that use arbitrary database connections under the attacker's control. This can allow full site takeover via an attacker who grants themselves administrator privileges on the new database, at which point the site they control shares a file system with the victim site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.91
Update the WordPress WPvivid Backup and Migration plugin to the latest available version (at least 0.9.91).
Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WPvivid Backup and Migration Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 0.9.91.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.91
The WPvivid Backup Plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_staging' and 'get_staging_progress' functions in versions up to, and including, 0.9.90. This makes it possible for authenticated attackers to create new staging sites and fresh WordPress installations on the server that use arbitrary database connections under the attacker's control. This can allow full site takeover via an attacker who grants themselves administrator privileges on the new database, at which point the site they control shares a file system with the victim site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.77
Authenticated Arbitrary File Deletion vulnerability discovered by WPScan in WordPress WPvivid Backup plugin (versions 0.9.76).
Update the WordPress WPvivid Backup and Migration plugin to the latest available version (at least 0.9.77).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.77
The WPvivid Backup plugin for WordPress is vulnerable to Path Traversal in version 0.9.76 due to a newly introduced delete_upload_incomplete_backup AJAX action. This allows administrator-level attackers to delete arbitrary files on the server.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2022-2863
The WPvivid backup plugin for WordPress is vulnerable to arbitrary file read due to missing parameter sanitization and validation on the 'file_name' parameter in versions up to, and including, 0.9.75. This makes it possible for authenticated attackers, with administrator level permissions and above, to access arbitrary files on the affected sites server.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.76
The WPvivid plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 0.9.75. This allows authenticated users with administrative privileges to download arbitrary files on the server, including sensitive configuration files, though the file size must be successfully guessed in order to do so.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2022-2442
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2022-27844
The plugin does not properly validates log files to be accessed, which could allow high privilege users such as admin to download arbitrary files on the server
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
CVE-2022-0531
The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24994
The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.56
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 0.9.55 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.53
SQL Injection (SQLi) vulnerability discovered in WordPress WPvivid Backup and Migration plugin (versions <= 0.9.52).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.36
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wp_ajax_wpvivid_add_remote AJAX action that allows low-level authenticated attackers to send back-ups to a remote location of their choice for review. This affects versions up to, and including 0.9.35.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.36
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.36
Missing Authorization vulnerability leading to Database Leak discovered by Dave Jong (Patchstack) in WordPress WPvivid Backup and Migration plugin (versions <= 0.9.35).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2025-5961
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-1357
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process combined with a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using openssl_private_decrypt(), it does not terminate execution and instead passes the boolean false value to the phpseclib library's AES cipher initialization. The library treats this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Additionally, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This makes it possible for unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the wpvivid_action=send_to_site parameter.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.56
The plugin does not escape the tab parameter before outputting it back in an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.77
The plugin introduced an issue in its delete_upload_incomplete_backup AJAX action, which could allow high privilege users to delete arbitrary file on the server via a path traversal attack
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.36
There is a missing authorization check in the WPvivid Backup plugin that can lead to the exposure of the database and all files of the WordPress site.
wp_ajax_wpvivid_add_remote does not check if the current user has the proper permission to execute the action to add a new remote backup location, nor does it (and many other AJAX actions in the plugin) contain a nonce check which causes a CSRF issue.
It allows any authenticated user, regardless of their user role, to add a new remote storage location and set it as the default backup location.
This means that the next time the backup runs, it will use this backup location and upload the backup to this location.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.91
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup path parameter in versions up to, and including, 0.9.90 due to insufficient input sanitization and output escaping on the 'path' setting. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Mantén Wpvivid Backuprestore actualizado — 0.9.130 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.