Updraftplus

This hub aggregates every CVE we track for Updraftplus, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 12 most recently published vulnerabilities affecting Updraftplus.

• CVE-2024-10957UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection8.8Jan 4, 2025
• CVE-2023-5982UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update5.4Nov 7, 2023
• CVE-2023-32960WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF)7.1Jun 22, 2023
• CVE-2022-0864UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting6.1Apr 4, 2022
• CVE-2022-0633UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup Download6.5Feb 17, 2022
• CVE-2021-25089UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting6.1Feb 1, 2022
• CVE-2021-24423UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site Scripting4.8Jan 24, 2022
• CVE-2021-25022UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting6.1Jan 3, 2022
• CVE-2015-9360The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().6.1Aug 28, 2019
• CVE-2017-18593The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.6.1Aug 28, 2019
• CVE-2017-16871The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before d...8.1Nov 17, 2017
• CVE-2017-16870The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports th...8.1Nov 17, 2017