Login Request a demo
UP
Product
Updraftplus
by Updraftplus · last CVE Nov 7, 2023
11
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 0High 2Medium 9Low 0
Severity
All severities11Critical0High2Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Updraftplus to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2017-16871
8.1
2%
Nov 17
The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race…
Affected: through 1.13.12
CVE-2017-16870
8.1
1%
Nov 17
The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction
Affected: through 1.13.12
CVE-2022-0633
6.5
2%
Feb 17
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier,…
Affected: before 1.22.3; before 2.22.3
CVE-2023-32960
6.1
0%
Jun 22
WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF)
Affected: through 1.23.3
CVE-2022-0864
6.1
7%
Apr 4
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page,…
Affected: before 1.22.9
CVE-2021-25089
6.1
1%
Feb 1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page,…
Affected: before 1.16.69
CVE-2021-25022
6.1
1%
Jan 3
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin…
Affected: before 1.16.66
CVE-2017-18593
6.1
1%
Aug 28
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file
Affected: before 1.13.5
CVE-2015-9360
6.1
1%
Aug 28
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg()
Affected: before 1.9.64
CVE-2023-5982
5.4
0%
Nov 7
UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update
Affected: through 1.23.10
CVE-2021-24423
4.8
1%
Jan 24
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript…
Affected: before 1.16.59
Showing 11