Skip to content
Noroxi

UpdraftPlus records

19 published records for vendor updraftplus.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
10.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 22
  4. 23
  5. 24
  6. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

19 records
  • CVE-2017-16871
    32Monitor

    The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/pl

    HighCVSS 8.1No exploitEPSS 2%

    updraftplus · updraftplusNov 17, 2017

  • CVE-2017-16870
    32Monitor

    The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.

    HighCVSS 8.1No exploitEPSS 1%

    updraftplus · updraftplusNov 17, 2017

  • CVE-2023-0157
    29Monitor

    All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS

    MediumCVSS 4.8Proof of conceptEPSS 32%

    updraftplus · all-in-one securityApr 10, 2023

  • CVE-2022-0633
    27Monitor

    UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup Download

    MediumCVSS 6.5No exploitEPSS 2%

    updraftplus · updraftplusFeb 17, 2022

  • CVE-2022-0864
    26Monitor

    UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 7%

    updraftplus · updraftplusApr 4, 2022

  • CVE-2023-0156
    25Monitor

    All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

    MediumCVSS 4.9Proof of conceptEPSS 20%

    updraftplus · all-in-one securityApr 10, 2023

  • CVE-2023-1119
    24Monitor

    Multiple Plugins - Cross-Site Scripting From Third-party Library

    MediumCVSS 6.1Proof of conceptEPSS 1%

    srbtranslatin project · srbtranslatinJul 10, 2023

  • CVE-2021-25022
    24Monitor

    UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 1%

    updraftplus · updraftplusJan 3, 2022

  • CVE-2015-9360
    24Monitor

    The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 1%

    updraftplus · updraftplusAug 28, 2019

  • CVE-2017-18593
    24Monitor

    The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.

    MediumCVSS 6.1No exploitEPSS 1%

    updraftplus · updraftplusAug 28, 2019

  • CVE-2021-25089
    24Monitor

    UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 1%

    updraftplus · updraftplusFeb 1, 2022

  • CVE-2024-1037
    24Monitor

    All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 1%

    updraftplus · all-in-one securityFeb 7, 2024

  • CVE-2023-26530
    24Monitor

    WordPress Updraft Plugin <= 0.6.1 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1No exploitEPSS 0%

    updraftplus · updraftAug 17, 2023

  • CVE-2023-32960
    24Monitor

    WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF)

    MediumCVSS 6.1No exploitEPSS 0%

    updraftplus · updraftplusJun 22, 2023

  • CVE-2022-4346
    21Monitor

    All In One WP Security & Firewall < 5.1.3 - Configuration Leak

    MediumCVSS 5.3No exploitEPSS 1%

    updraftplus · all-in-one securityJan 23, 2023

  • CVE-2022-4097
    21Monitor

    All In One WP Security & Firewall < 5.0.8 - IP Spoofing

    MediumCVSS 5.3No exploitEPSS 1%

    updraftplus · all-in-one securityDec 12, 2022

  • CVE-2023-5982
    21Monitor

    UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update

    MediumCVSS 5.4No exploitEPSS 0%

    updraftplus · updraftplusNov 7, 2023

  • CVE-2021-24423
    19Monitor

    UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site Scripting

    MediumCVSS 4.8No exploitEPSS 1%

    updraftplus · updraftplusJan 24, 2022

  • CVE-2025-3951
    16Monitor

    WP-Optimize < 4.2.0 - Admin+ SQLi

    MediumCVSS 4.1No exploitEPSS 0%

    updraftplus · wp-optimizeJun 2, 2025