CVE-2022-2863: Improper Limitation of a Pathname to a Restricted Directory

The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack...

CVE-2022-0531: Improper Neutralization of Input During Web Page Generation

The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the subpage parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting...

PT-2022-13243

Name of the Vulnerable Software and Affected Versions Migration, Backup, Staging WordPress plugin versions prior to 0.9.70 Description The issue is related to a reflected Cross-Site Scripting problem. It occurs because the sub page parameter is not properly sanitised and escaped before being...

CVE-2021-24994: Improper Neutralization of Input During Web Page Generation

The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue...