Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-08
WPvivid - Improper Input Validation (CVE-2026-82194)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
PLUGIN
WPvivid
CVE-2026-82194
Risk Score
Threat Entry
Updated 2026-09-08
WPvivid - Improper Input Validation (CVE-2026-82193)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
PLUGIN
WPvivid
CVE-2026-82193
Risk Score
Threat Entry
Updated 2026-09-03
WPvivid - SQL Injection (CVE-2026-82182)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.
PLUGIN
WPvivid
CVE-2026-82182
Risk Score
Threat Entry
Updated 2026-09-03
WPvivid - Improper Input Validation (CVE-2026-19722)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.
PLUGIN
WPvivid
CVE-2026-19722
Risk Score
Threat Entry
Updated 2026-08-26
WPvivid - Cross-Site Scripting (XSS) (CVE-2026-19725)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the…
PLUGIN
WPvivid
CVE-2026-19725
Risk Score
Threat Entry
Updated 2026-06-17
WPvivid - Broken Access Control (CVE-2023-4637)
The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() function in versions up to, and including, 0.9.94. This makes it possible for unauthenticated attackers to invoke these functions and obtain full file paths if they have access to a back-up ID.
PLUGIN
WPvivid
CVE-2023-4637
Risk Score