UP
Vendor
Updraftplus
19
CVEs
0
On KEV
0
New 30D
Products
UP8.1
Updraftplus
Updraftplus
11 CVEs0 on KEV0 new
AS6.1
All-in-one Security
Updraftplus
5 CVEs0 on KEV0 new
WP6.1
Wp-optimize
Updraftplus
2 CVEs0 on KEV0 new
UP6.1
Updraft
Updraftplus
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-3951 | WP Wp-optimize Updraftplus | 4.1 | Jun 2 | WP-Optimize < 4.2.0 - Admin+ SQLi |
| CVE-2024-1037 | AS All-in-one Security Updraftplus | 6.1 | Feb 7 | All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting |
| CVE-2023-5982 | UP Updraftplus Updraftplus | 5.4 | Nov 7 | UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update |
| CVE-2023-26530 | UP Updraft Updraftplus | 6.1 | Aug 17 | WordPress Updraft Plugin <= 0.6.1 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-1119 | WP Wp-optimize Updraftplus | 6.1 | Jul 10 | Multiple Plugins - Cross-Site Scripting From Third-party Library |
| CVE-2023-32960 | UP Updraftplus Updraftplus | 6.1 | Jun 22 | WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF) |
| CVE-2023-0157 | AS All-in-one Security Updraftplus | 4.8 | Apr 10 | All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS |
| CVE-2023-0156 | AS All-in-one Security Updraftplus | 4.9 | Apr 10 | All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal |
| CVE-2022-4346 | AS All-in-one Security Updraftplus | 5.3 | Jan 23 | All In One WP Security & Firewall < 5.1.3 - Configuration Leak |
| CVE-2022-4097 | AS All-in-one Security Updraftplus | 5.3 | Dec 12 | All In One WP Security & Firewall < 5.0.8 - IP Spoofing |
| CVE-2022-0864 | UP Updraftplus Updraftplus | 6.1 | Apr 4 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page,… |
| CVE-2022-0633 | UP Updraftplus Updraftplus | 6.5 | Feb 17 | The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier,… |
| CVE-2021-25089 | UP Updraftplus Updraftplus | 6.1 | Feb 1 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page,… |
| CVE-2021-24423 | UP Updraftplus Updraftplus | 4.8 | Jan 24 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript… |
| CVE-2021-25022 | UP Updraftplus Updraftplus | 6.1 | Jan 3 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin… |
| CVE-2017-18593 | UP Updraftplus Updraftplus | 6.1 | Aug 28 | The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file |
| CVE-2015-9360 | UP Updraftplus Updraftplus | 6.1 | Aug 28 | The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg() |
| CVE-2017-16871 | UP Updraftplus Updraftplus | 8.1 | Nov 17 | The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race… |
| CVE-2017-16870 | UP Updraftplus Updraftplus | 8.1 | Nov 17 | The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction |