Design/Logic Flaw

The updraftplus plugin before 1.9.64 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9360

The CVE covers the UpdraftPlus WordPress backup plugin. Affected: UpdraftPlus plugin before version 1.9.64. Vulnerability: XSS via add_query_arg() and remove_query_arg(). Root cause: improper handling of query arguments enabling client-side script injection. Impact: cross-site scripting accessibl...

CVE-2015-9360

The updraftplus plugin before 1.9.64 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2017-18593

The CVE-2017-18593 entry affects the WordPress UpdraftPlus plugin, specifically versions prior to 1.13.5. The vulnerability is an XSS issue that occurs in rare cases when an attacker can influence a string logged to a log file, enabling client-side script execution. Affected component: UpdraftPlu...

CVE-2017-18593

The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file...

CVE-2015-9360: Improper Neutralization of Input During Web Page Generation

The updraftplus plugin before 1.9.64 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2017-18593: Improper Neutralization of Input During Web Page Generation

The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file...

WordPress UpdraftPlus Plugin Server-Side Request Forgery Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.UpdraftPlus plugin is used in one of the WordPress backup plugin. WordPress UpdraftPlus plugin 1.13.12 and earlier...

WordPress UpdraftPlus Plugin Multiple Vulnerabilities

These CVE SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.140535";...

CVE-2017-16871

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross ...

CVE-2017-16871

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross ...

CVE-2017-16870

The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraftajaxhandler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary...

Cross site scripting

DISPUTED The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraftajaxhandler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary...

Race condition

DISPUTED The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does n...

CVE-2017-16870

The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraftajaxhandler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary...

CVE-2017-16871

The CVE-2017-16871 entry concerns the WordPress UpdraftPlus plugin (versions up to 1.13.12). A race condition in the plupload_action function, before deleting a file tied to the name parameter in /wp-content/plugins/updraftplus/admin.php, allows remote PHP code execution. The vendor notes this do...

CVE-2017-16871

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross ...

CVE-2017-16870

The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraftajaxhandler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary...

CVE-2017-16870

CVE-2017-16870 affects WordPress UpdraftPlus plugin up to version 1.13.12. The vulnerability is a server-side request forgery (SSRF) in the updraft_ajax_handler function of /wp-content/plugins/updraftplus/admin.php, exploitable via an httpget subaction. The vendor notes that this does not cross a...

CVE-2017-16871: Improper Control of Generation of Code

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross ...