Advisories · Technology

davidanderson UpdraftPlus: WP Backup & Migration Plugin.

Every CVE that names davidanderson UpdraftPlus: WP Backup & Migration Plugin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-10795 CVE record

CVSS 8.1 High

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
- davidanderson UpdraftPlus: WP Backup & Migration Plugin
- Weak cryptography or TLS
Not analysed yet 11 Jun 2026
CVE-2025-0215 CVE record

CVSS 6.1 Medium

UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting
- davidanderson UpdraftPlus: WP Backup & Migration Plugin
- Cross-site scripting (XSS)
Not analysed yet 15 Jan 2025
CVE-2024-10957 CVE record

CVSS 8.8 High

UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection
- davidanderson UpdraftPlus: WP Backup & Migration Plugin
- Insecure deserialization
Not analysed yet 4 Jan 2025
CVE-2023-5982 CVE record

CVSS 5.4 Medium

UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update
- davidanderson UpdraftPlus: WP Backup & Migration Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 7 Nov 2023