Plugin security history

WPvivid — Backup, Migration & Staging Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 28 vulnerability records associated with WPvivid — Backup, Migration & Staging, published between 2020 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

28Total records

2Critical

10High

14Medium

2Low

0Informational

28Patched records

0Currently marked unpatched

2020-03-13First disclosure

2026-07-31Latest disclosure

25 of 28CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	2	2 records
2021	1	1 records
2022	7	7 records
2023	5	5 records
2024	6	6 records
2025	4	4 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
Critical	2	7.1%
High	10	35.7%
Medium	14	50%
Low	2	7.1%

Vulnerability-Type Breakdown

Path Traversal

6 records21.4%

First: 2022. Latest: 2026.

Cross-Site Scripting

5 records17.9%

First: 2021. Latest: 2023.

Arbitrary File Upload

4 records14.3%

First: 2020. Latest: 2026.

Information Disclosure

4 records14.3%

First: 2020. Latest: 2024.

Missing Authorization

4 records14.3%

First: 2023. Latest: 2025.

Other

3 records10.7%

First: 2022. Latest: 2024.

SQL Injection

2 records7.1%

First: 2024. Latest: 2026.

Patch Status

Patched: 28
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

0.9.132
0.9.129
0.9.124
0.9.121
0.9.117
0.9.113
0.9.107
0.9.108
0.9.106
0.9.100
0.9.95
0.9.92
0.9.90
0.9.91
0.9.77
0.9.76
0.9.75
0.9.71
0.9.70
0.9.69
0.9.56
0.9.36

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-0.9.131`	WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter	July 31, 2026	0.9.132	Medium
`*-0.9.128`	Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion	June 5, 2026	0.9.129	Low
`*-0.9.123`	Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload	February 10, 2026	0.9.124	Critical
`*-0.9.120`	Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation	December 20, 2025	0.9.121	Low
`*-0.9.116`	Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload	July 3, 2025	0.9.117	High
`*-0.9.112`	Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file	February 21, 2025	0.9.113	High
`*-0.9.106`	WPvivid Backup and Migration <= 0.9.106 - Missing Authorization	January 3, 2025	0.9.107	Medium
`*-0.9.107`	Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection	November 13, 2024	0.9.108	High
`*-0.9.105`	Migration, Backup, Staging – WPvivid <= 0.9.105 - Sensitive Information Exposure	September 11, 2024	0.9.106	High
`*-0.9.99`	WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization	April 11, 2024	0.9.100	High
`0.9.68`	WPvivid Backup and Migration <= 0.9.68 - Unauthenticated SQL Injection	February 28, 2024	0.9.69	Critical
`*-0.9.68`	WPvivid Backup and Migration <= 0.9.68 - Missing Authorization	February 28, 2024	0.9.69	Medium
`*-0.9.94`	WPvivid <= 0.9.94 - Missing Authorization	January 19, 2024	0.9.95	Medium
`*-0.9.91`	Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure	October 13, 2023	0.9.92	High
`*-0.9.89`	Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scripting	September 22, 2023	0.9.90	Medium
`0.9.89`	Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal	September 22, 2023	0.9.90	High
`*-0.9.89`	Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated Stored Cross-Site Scripting	September 22, 2023	0.9.90	Medium
`[*, 0.9.91)`	WPvivid Backup Plugin <= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress'	September 12, 2023	0.9.91	High
`0.9.76`	WPvivid Backup 0.9.76 - Authenticated (Administrator+) Arbitrary File Deletion	August 29, 2022	0.9.77	Medium
`*-0.9.75`	Migration, Backup, Staging – WPvivid <= 0.9.75 - Authenticated (Administrator+) Path Traversal	August 22, 2022	0.9.76	Medium
`*-0.9.75`	Migration, Backup, Staging – WPvivid <= 0.9.75 - Authenticated (Admin+) Directory Traversal	August 16, 2022	0.9.76	Medium
`*-0.9.74`	Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization	August 10, 2022	0.9.75	High
`*-0.9.70`	Migration, Backup, Staging – WPvivid <= 0.9.70 - Authenticated Arbitrary File Read	April 7, 2022	0.9.71	Medium
`[*, 0.9.70)`	Migration, Backup, Staging – WPvivid <= 0.9.69 - Reflected Cross-Site Scripting via sub_page Parameter	March 21, 2022	0.9.70	Medium
`[*, 0.9.69)`	Migration, Backup, Staging – WPvivid <= 0.9.68 - Unauthenticated Stored Cross-Site Scripting	January 31, 2022	0.9.69	Medium

Selected source records

Latest Records

MediumCVE-2026-17555

WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter

Published: July 31, 2026

Affected versions: *-0.9.131
Patched versions: 0.9.132

Original Wordfence record

LowCVE-2025-12656

Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion

Published: June 5, 2026

Affected versions: *-0.9.128
Patched versions: 0.9.129

Original Wordfence record

CriticalCVE-2026-1357

Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload

Published: February 10, 2026

Affected versions: *-0.9.123
Patched versions: 0.9.124

Original Wordfence record

LowCVE-2025-12654

Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation

Published: December 20, 2025

Affected versions: *-0.9.120
Patched versions: 0.9.121

Original Wordfence record

HighCVE-2025-5961

Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload

Published: July 3, 2025

Affected versions: *-0.9.116
Patched versions: 0.9.117

Original Wordfence record

HighCVE-2024-13869

Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file

Published: February 21, 2025

Affected versions: *-0.9.112
Patched versions: 0.9.113

Original Wordfence record

MediumCVE-2024-56273

WPvivid Backup and Migration <= 0.9.106 - Missing Authorization

Published: January 3, 2025

Affected versions: *-0.9.106
Patched versions: 0.9.107

Original Wordfence record

HighCVE-2024-10962

Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection

Published: November 13, 2024

Affected versions: *-0.9.107
Patched versions: 0.9.108

Original Wordfence record

Highest-Severity Records

CriticalCVE-2026-1357

Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload

Published: February 10, 2026

Affected versions: *-0.9.123
Patched versions: 0.9.124

Original Wordfence record

CriticalCVE-2024-1981

WPvivid Backup and Migration <= 0.9.68 - Unauthenticated SQL Injection

Published: February 28, 2024

Affected versions: 0.9.68
Patched versions: 0.9.69

Original Wordfence record

HighCVE-2024-10962

Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection

Published: November 13, 2024

Affected versions: *-0.9.107
Patched versions: 0.9.108

Original Wordfence record

HighCVE-2020-36842

Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload

Published: March 13, 2020

Affected versions: *-0.9.35
Patched versions: 0.9.36

Original Wordfence record

HighCVE-2023-4274

Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal

Published: September 22, 2023

Affected versions: 0.9.89
Patched versions: 0.9.90

Original Wordfence record

HighCVE-2023-41243

WPvivid Backup Plugin <= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress'

Published: September 12, 2023

Affected versions: [*, 0.9.91)
Patched versions: 0.9.91

Original Wordfence record

HighCVE-2023-5576

Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure

Published: October 13, 2023

Affected versions: *-0.9.91
Patched versions: 0.9.92

Original Wordfence record

HighCVE-2024-7315

Migration, Backup, Staging – WPvivid <= 0.9.105 - Sensitive Information Exposure

Published: September 11, 2024

Affected versions: *-0.9.105
Patched versions: 0.9.106

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory