WordPress plugin
WPvivid — Backup, Migration & Staging security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 37 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High14
- Medium18
- Low3
All WPvivid — Backup, Migration & Staging vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.9 | Authenticated (Administrator+) Path Traversal <0.9.138Update to 0.9.138 | CVE-2026-115426 | |
| High7.2 | 0.9.136 - Authenticated (Administrator+) Arbitrary File Upload 0.9.117 – 0.9.136Update to 0.9.137 | CVE-2026-115243 | |
| Low2.7 | Authenticated (Administrator+) Arbitrary Database Table Deletion <0.9.137Update to 0.9.137 | CVE-2026-115241 | |
| Medium4.9 | Authenticated (Administrator+) Path Traversal <0.9.137Update to 0.9.137 | CVE-2026-115242 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection <0.9.133Update to 0.9.133 | CVE-2026-82182 | |
| Medium6.5 | Authenticated (Administrator+) Arbitrary File Deletion <0.9.134Update to 0.9.134 | CVE-2026-82194 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload <0.9.134Update to 0.9.134 | CVE-2026-82193 | |
| High7.2 | Authenticated (Administrator+) Remote Code Execution <0.9.133Update to 0.9.133 | CVE-2026-19722 | |
| High7.5 | Unauthenticated Path Traversal <0.9.131Update to 0.9.131 | CVE-2026-19725 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection via 'export_data' Parameter ≤0.9.131Update to 0.9.132 | CVE-2026-17555 | |
| Low3.8 | Authenticated (Admin+) Arbitrary Directory Deletion ≤0.9.128Update to 0.9.129 | CVE-2025-12656 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤0.9.123Update to 0.9.124 | CVE-2026-1357 | |
| Low2.7 | Authenticated (Admin+) Arbitrary Directory Creation ≤0.9.120Update to 0.9.121 | CVE-2025-12654 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload ≤0.9.116Update to 0.9.117 | CVE-2025-5961 | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file ≤0.9.112Update to 0.9.113 | CVE-2024-13869 | |
| Medium5.3 | Missing Authorization ≤0.9.106Update to 0.9.107 | CVE-2024-56273 | |
| High8.8 | Unauthenticated PHP Object Injection ≤0.9.107Update to 0.9.108 | CVE-2024-10962 | |
| High7.5 | Sensitive Information Exposure ≤0.9.105Update to 0.9.106 | CVE-2024-7315 | |
| High7.2 | Authenticated (Admin+) PHAR Deserialization ≤0.9.99Update to 0.9.100 | CVE-2024-3054 | |
| Critical9.8 | Unauthenticated SQL Injection 0.9.68 – 0.9.68Update to 0.9.69 | CVE-2024-1981 | |
| Medium6.5 | Missing Authorization ≤0.9.68Update to 0.9.69 | CVE-2024-1982 | |
| Medium4.3 | Missing Authorization ≤0.9.94Update to 0.9.95 | CVE-2023-4637 | |
| High8.0 | Google Drive Client Secret Exposure ≤0.9.91Update to 0.9.92 | CVE-2023-5576 | |
| Medium4.4 | Authenticated Stored Cross-Site Scripting ≤0.9.89Update to 0.9.90 | CVE-2023-5120 | |
| High8.7 | Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal 0.9.89 – 0.9.89Update to 0.9.90 | CVE-2023-4274 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤0.9.89Update to 0.9.90 | CVE-2023-5121 | |
| High8.3 | Missing Authorization via 'start_staging' and 'get_staging_progress' <0.9.91Update to 0.9.91 | CVE-2023-41243 | |
| Medium6.5 | Authenticated (Administrator+) Arbitrary File Deletion 0.9.76 – 0.9.76Update to 0.9.77 | — | |
| Medium6.5 | Authenticated (Administrator+) Path Traversal ≤0.9.75Update to 0.9.76 | CVE-2022-2863 | |
| Medium6.0 | Authenticated (Admin+) Directory Traversal ≤0.9.75Update to 0.9.76 | — | |
| High7.2 | Authenticated (Admin+) PHAR Deserialization ≤0.9.74Update to 0.9.75 | CVE-2022-2442 | |
| Medium4.9 | Authenticated Arbitrary File Read ≤0.9.70Update to 0.9.71 | CVE-2022-27844 | |
| Medium6.1 | Reflected Cross-Site Scripting via sub_page Parameter <0.9.70Update to 0.9.70 | CVE-2022-0531 | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting <0.9.69Update to 0.9.69 | CVE-2021-24994 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤0.9.55Update to 0.9.56 | — | |
| Medium4.9 | Sensitive Information Disclosure <0.9.36Update to 0.9.36 | CVE-2020-36835 | |
| High8.8 | Authenticated (Subscriber+) Arbitrary File Upload ≤0.9.35Update to 0.9.36 | CVE-2020-36842 |
- Medium4.9Authenticated (Administrator+) Path Traversal
<0.9.138Update to 0.9.138
- High7.20.9.136 - Authenticated (Administrator+) Arbitrary File Upload
0.9.117 – 0.9.136Update to 0.9.137
- Low2.7Authenticated (Administrator+) Arbitrary Database Table Deletion
<0.9.137Update to 0.9.137
- Medium4.9Authenticated (Administrator+) Path Traversal
<0.9.137Update to 0.9.137
- Medium4.9Authenticated (Administrator+) SQL Injection
<0.9.133Update to 0.9.133
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
<0.9.134Update to 0.9.134
- High7.2Authenticated (Administrator+) Arbitrary File Upload
<0.9.134Update to 0.9.134
- High7.2Authenticated (Administrator+) Remote Code Execution
<0.9.133Update to 0.9.133
- High7.5Unauthenticated Path Traversal
<0.9.131Update to 0.9.131
- Medium4.9Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
≤0.9.131Update to 0.9.132
- Low3.8Authenticated (Admin+) Arbitrary Directory Deletion
≤0.9.128Update to 0.9.129
- Critical9.8Unauthenticated Arbitrary File Upload
≤0.9.123Update to 0.9.124
- Low2.7Authenticated (Admin+) Arbitrary Directory Creation
≤0.9.120Update to 0.9.121
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤0.9.116Update to 0.9.117
- High7.2Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
≤0.9.112Update to 0.9.113
- Medium5.3Missing Authorization
≤0.9.106Update to 0.9.107
- High8.8Unauthenticated PHP Object Injection
≤0.9.107Update to 0.9.108
- High7.5Sensitive Information Exposure
≤0.9.105Update to 0.9.106
- High7.2Authenticated (Admin+) PHAR Deserialization
≤0.9.99Update to 0.9.100
- Critical9.8Unauthenticated SQL Injection
0.9.68 – 0.9.68Update to 0.9.69
- Medium6.5Missing Authorization
≤0.9.68Update to 0.9.69
- Medium4.3Missing Authorization
≤0.9.94Update to 0.9.95
- High8.0Google Drive Client Secret Exposure
≤0.9.91Update to 0.9.92
- Medium4.4Authenticated Stored Cross-Site Scripting
≤0.9.89Update to 0.9.90
- High8.7Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal
0.9.89 – 0.9.89Update to 0.9.90
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤0.9.89Update to 0.9.90
- High8.3Missing Authorization via 'start_staging' and 'get_staging_progress'
<0.9.91Update to 0.9.91
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
0.9.76 – 0.9.76Update to 0.9.77
- Medium6.5Authenticated (Administrator+) Path Traversal
≤0.9.75Update to 0.9.76
- Medium6.0Authenticated (Admin+) Directory Traversal
≤0.9.75Update to 0.9.76
- High7.2Authenticated (Admin+) PHAR Deserialization
≤0.9.74Update to 0.9.75
- Medium4.9Authenticated Arbitrary File Read
≤0.9.70Update to 0.9.71
- Medium6.1Reflected Cross-Site Scripting via sub_page Parameter
<0.9.70Update to 0.9.70
- Medium6.1Unauthenticated Stored Cross-Site Scripting
<0.9.69Update to 0.9.69
- Medium6.1Reflected Cross-Site Scripting
≤0.9.55Update to 0.9.56
- Medium4.9Sensitive Information Disclosure
<0.9.36Update to 0.9.36
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤0.9.35Update to 0.9.36
WPvivid — Backup, Migration & Staging: common questions
Does WPvivid — Backup, Migration & Staging have known vulnerabilities?
Yes. VulnCrest Radar lists 37 known vulnerabilities in WPvivid — Backup, Migration & Staging: 2 critical, 14 high, 18 medium, 3 low. None are known to affect version null.
How do I check which version of WPvivid — Backup, Migration & Staging I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPvivid — Backup, Migration & Staging vulnerability?
CVE-2026-115426, published Nov 4, 2026: WPvivid — Backup, Migration & Staging < 0.9.138 - Authenticated (Administrator+) Path Traversal. Severity: Medium (CVSS 4.9).
Is any WPvivid — Backup, Migration & Staging vulnerability listed in CISA KEV?
No. None of the known WPvivid — Backup, Migration & Staging vulnerabilities is currently listed in the CISA KEV catalog.