EUVD-2026-116726

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an...

CVE-2026-115242

The WPvivid — Backup, Migration & Staging WordPress plugin versions before 0.9.137 is vulnerable to a path traversal flaw. The staging-start handler fails to properly sanitize the staging destination folder, applying only a generic text filter instead of the correct filename sanitizer used in oth...