← All plugins

Plugin vulnerabilities

Is WPvivid safe? Known vulnerabilities and the version to run.

WPvivid Backup & Migration: backs up, migrates and stages WordPress sites, with copies kept on the server or in cloud storage.

Updated from Wordfence Intelligence

The short answer

Run WPvivid 0.9.138 or later. That version has a fix for every known vulnerability that's been patched.

Known vulnerabilities
37
In the last 12 months
13
Rated high or critical
16
No fix yet
0

Every known WPvivid vulnerability

Newest first. The most recent was disclosed on 4 November 2026. Each one links to its full record on Wordfence.

VulnerabilitySeverityAffected versionsFixed in
Authenticated (Administrator+) Path TraversalCVE-2026-115426 · 4 November 2026Medium 4.9before 0.9.1380.9.138
WPvivid — Backup, Migration & Staging 0.9.117 - 0.9.136 - Authenticated (Administrator+) Arbitrary File UploadCVE-2026-115243 · 4 November 2026High 7.20.9.117 to 0.9.1360.9.137
Authenticated (Administrator+) Arbitrary Database Table DeletionCVE-2026-115241 · 4 November 2026Low 2.7before 0.9.1370.9.137
Authenticated (Administrator+) Path TraversalCVE-2026-115242 · 4 November 2026Medium 4.9before 0.9.1370.9.137
Authenticated (Administrator+) Arbitrary File DeletionCVE-2026-82194 · 2 September 2026Medium 6.5before 0.9.1340.9.134
Authenticated (Administrator+) Arbitrary File UploadCVE-2026-82193 · 2 September 2026High 7.2before 0.9.1340.9.134
Authenticated (Administrator+) SQL InjectionCVE-2026-82182 · 2 September 2026Medium 4.9before 0.9.1330.9.133
Authenticated (Administrator+) Remote Code ExecutionCVE-2026-19722 · 30 August 2026High 7.2before 0.9.1330.9.133
Unauthenticated Path TraversalCVE-2026-19725 · 20 August 2026High 7.5before 0.9.1310.9.131
Authenticated (Administrator+) SQL Injection via 'export_data' ParameterCVE-2026-17555 · 31 July 2026Medium 4.90.9.131 and earlier0.9.132
Authenticated (Admin+) Arbitrary Directory DeletionCVE-2025-12656 · 5 June 2026Low 3.80.9.128 and earlier0.9.129
Unauthenticated Arbitrary File UploadCVE-2026-1357 · 10 February 2026Critical 9.80.9.123 and earlier0.9.124
Authenticated (Admin+) Arbitrary Directory CreationCVE-2025-12654 · 20 December 2025Low 2.70.9.120 and earlier0.9.121
Authenticated (Administrator+) Arbitrary File UploadCVE-2025-5961 · 3 July 2025High 7.20.9.116 and earlier0.9.117
Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_fileCVE-2024-13869 · 21 February 2025High 7.20.9.112 and earlier0.9.113
Missing AuthorizationCVE-2024-56273 · 3 January 2025Medium 5.30.9.106 and earlier0.9.107
Unauthenticated PHP Object InjectionCVE-2024-10962 · 13 November 2024High 8.80.9.107 and earlier0.9.108
Sensitive Information ExposureCVE-2024-7315 · 11 September 2024High 7.50.9.105 and earlier0.9.106
Authenticated (Admin+) PHAR DeserializationCVE-2024-3054 · 11 April 2024High 7.20.9.99 and earlier0.9.100
Missing AuthorizationCVE-2024-1982 · 28 February 2024Medium 6.50.9.68 and earlier0.9.69
Unauthenticated SQL InjectionCVE-2024-1981 · 28 February 2024Critical 9.80.9.680.9.69
Missing AuthorizationCVE-2023-4637 · 19 January 2024Medium 4.30.9.94 and earlier0.9.95
Google Drive Client Secret ExposureCVE-2023-5576 · 13 October 2023High 8.00.9.91 and earlier0.9.92
Authenticated Stored Cross-Site ScriptingCVE-2023-5120 · 22 September 2023Medium 4.40.9.89 and earlier0.9.90
Authenticated (Administrator+) Arbitrary Directory Deletion via Path TraversalCVE-2023-4274 · 22 September 2023High 8.70.9.890.9.90

If you run WPvivid

What to do now

  1. Check your version. In WordPress, go to Plugins and look under WPvivid. Compare it with the affected versions above.
  2. Update to 0.9.138 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
  3. Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.

Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.

Backups and migration

All-in-One WP Migration

A plugin for moving a WordPress site to a new host or domain.

18 known5 in the last year

UpdraftPlus

A backup plugin that saves copies of your site to cloud storage.

20 known4 in the last year

Duplicator

A plugin for migrating, copying and backing up WordPress sites.

20 known5 in the last year

Backuply

Backs up WordPress sites to the server or cloud storage, with one-click restores.

6 known1 in the last year

BackWPup

Schedules backups of files and the database to cloud storage.

16 known7 in the last year

Data sources and licences

Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Not sure yet?

Find out how exposed your site is.

Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.

Get a free security check Or protect it now
Security check
yourbusiness.com
Example
1 urgent2 to fix
  • Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
  • WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
  • 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix