Path Traversal
6 records21.4%First: 2022. Latest: 2026.
Plugin security history
WPvivid — Backup, Migration & Staging Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 28 vulnerability records associated with WPvivid — Backup, Migration & Staging, published between 2020 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
28Total records
2Critical
10High
14Medium
2Low
0Informational
28Patched records
0Currently marked unpatched
2020-03-13First disclosure
2026-07-31Latest disclosure
25 of 28CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2020 | 2 | |
| 2021 | 1 | |
| 2022 | 7 | |
| 2023 | 5 | |
| 2024 | 6 | |
| 2025 | 4 | |
| 2026 | 3 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 2 | 7.1% |
| High | 10 | 35.7% |
| Medium | 14 | 50% |
| Low | 2 | 7.1% |
Vulnerability-Type Breakdown
Cross-Site Scripting
5 records17.9%First: 2021. Latest: 2023.
Arbitrary File Upload
4 records14.3%First: 2020. Latest: 2026.
Information Disclosure
4 records14.3%First: 2020. Latest: 2024.
Missing Authorization
4 records14.3%First: 2023. Latest: 2025.
Other
3 records10.7%First: 2022. Latest: 2024.
SQL Injection
2 records7.1%First: 2024. Latest: 2026.
Patch Status
- Patched
- 28
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
0.9.1320.9.1290.9.1240.9.1210.9.1170.9.1130.9.1070.9.1080.9.1060.9.1000.9.950.9.920.9.900.9.910.9.770.9.760.9.750.9.710.9.700.9.690.9.560.9.36
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-0.9.55 | Migration, Backup, Staging – WPvivid <= 0.9.55 - Reflected Cross-Site Scripting | August 9, 2021 | 0.9.56 | Medium |
[*, 0.9.36) | Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure | March 23, 2020 | 0.9.36 | Medium |
*-0.9.35 | Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload | March 13, 2020 | 0.9.36 | High |
Selected source records
Latest Records
MediumCVE-2026-17555
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
Published: July 31, 2026
- Affected versions
- *-0.9.131
- Patched versions
- 0.9.132
LowCVE-2025-12656
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion
Published: June 5, 2026
- Affected versions
- *-0.9.128
- Patched versions
- 0.9.129
CriticalCVE-2026-1357
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
Published: February 10, 2026
- Affected versions
- *-0.9.123
- Patched versions
- 0.9.124
LowCVE-2025-12654
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation
Published: December 20, 2025
- Affected versions
- *-0.9.120
- Patched versions
- 0.9.121
HighCVE-2025-5961
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
Published: July 3, 2025
- Affected versions
- *-0.9.116
- Patched versions
- 0.9.117
HighCVE-2024-13869
Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
Published: February 21, 2025
- Affected versions
- *-0.9.112
- Patched versions
- 0.9.113
MediumCVE-2024-56273
WPvivid Backup and Migration <= 0.9.106 - Missing Authorization
Published: January 3, 2025
- Affected versions
- *-0.9.106
- Patched versions
- 0.9.107
HighCVE-2024-10962
Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection
Published: November 13, 2024
- Affected versions
- *-0.9.107
- Patched versions
- 0.9.108
Highest-Severity Records
CriticalCVE-2026-1357
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
Published: February 10, 2026
- Affected versions
- *-0.9.123
- Patched versions
- 0.9.124
CriticalCVE-2024-1981
WPvivid Backup and Migration <= 0.9.68 - Unauthenticated SQL Injection
Published: February 28, 2024
- Affected versions
- 0.9.68
- Patched versions
- 0.9.69
HighCVE-2024-10962
Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection
Published: November 13, 2024
- Affected versions
- *-0.9.107
- Patched versions
- 0.9.108
HighCVE-2020-36842
Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload
Published: March 13, 2020
- Affected versions
- *-0.9.35
- Patched versions
- 0.9.36
HighCVE-2023-4274
Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal
Published: September 22, 2023
- Affected versions
- 0.9.89
- Patched versions
- 0.9.90
HighCVE-2023-41243
WPvivid Backup Plugin <= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress'
Published: September 12, 2023
- Affected versions
- [*, 0.9.91)
- Patched versions
- 0.9.91
HighCVE-2023-5576
Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure
Published: October 13, 2023
- Affected versions
- *-0.9.91
- Patched versions
- 0.9.92
HighCVE-2024-7315
Migration, Backup, Staging – WPvivid <= 0.9.105 - Sensitive Information Exposure
Published: September 11, 2024
- Affected versions
- *-0.9.105
- Patched versions
- 0.9.106
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.