Wpvivid vulnerabilities
We track 10 vulnerabilities in Wpvivid products across 2 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on July 3, 2025.
Latest Wpvivid vulnerabilities
- 7.2 High severity
WPvivid — Backup, Migration & Staging: Unrestricted Upload of File with Dangerous Type
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes
- 7.2 High severity
WPvivid — Backup, Migration & Staging: Unrestricted Upload of File with Dangerous Type
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible fo
- 9.8 Critical severity
WPvivid Backup and Migration: Missing Authorization
Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPvivid Backup and Migration: from n/a through <= 0.9.106.
- 8.8 High severity
WPvivid — Backup, Migration & Staging: Deserialization of Untrusted Data
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replace_row_data' and 'replace_serialize_data' functions. This make
- 8.8 High severity
WPvivid Backup and Migration: Missing Authorization
Improper Privilege Management vulnerability in WPvivid Team WPvivid Backup and Migration allows Privilege Escalation.This issue affects WPvivid Backup and Migration: from n/a through 0.9.90.
- 7.2 High severity
WPvivid — Backup, Migration & Staging: Deserialization of Untrusted Data
WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not provi
- 9.1 Critical severity
WPvivid — Backup, Migration & Staging: Improper Neutralization of Special Elements used in an SQL Command
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_restore_progress() and restore() functions in all versions up to, and including, 0.9.68. This makes it possible for
- 9.1 Critical severity
Migration, Backup, Staging – WPvivid: Improper Neutralization of Special Elements used in an SQL Command
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9.68 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL q
- 9.3 Critical severity
WPvivid — Backup, Migration & Staging: Exposure of Sensitive Information to an Unauthorized Actor
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unau
- 7.2 High severity
WPvivid — Backup, Migration & Staging: Deserialization of Untrusted Data
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privilege