Inisev vulnerabilities
We track 9 vulnerabilities in Inisev products across 5 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest Inisev vulnerabilities
- 7.1 High severity
Social Share Icons & Social Share Buttons: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons:
- 7.2 High severity
Backup Migration: Improper Neutralization of Special Elements used in a Command
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()`
- 8.1 High severity
Copy & Delete Posts: Incorrect Authorization
Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function ca
- 8.8 High severity
BackupBliss – Backup & Migration with Free…: Deserialization of Untrusted Data
The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attac
- 7.5 High severity
BackupBliss – Backup & Migration with Free…: Files or Directories Accessible to External Parties
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible fo
- 7.2 High severity
BackupBliss – Backup & Migration with Free…: Improper Neutralization of Special Elements used in an OS Command
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute a
- 9.8 Critical severity
BackupBliss – Backup & Migration with Free…: Improper Limitation of a Pathname to a Restricted Directory
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possibl
- 9.8 Critical severity
BackupBliss – Backup & Migration with Free…: Improper Control of Generation of Code
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subseque
- 8.8 High severity
Social Media Share Buttons & Social Sharing…: Cross-Site Request Forgery
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX