Read the docs

UpdraftPlus

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

UpdraftPlus records in CISA KEV

No UpdraftPlus vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Updraftplus 11 records MEDIUM All-in-one Security 5 records MEDIUM Wp-optimize 2 records MEDIUM Updraft 1 record LOW

Records

2 records in Wp-optimize · all components

TI-2023-01059 CVE-2023-1119 · GHSA-2fmj-pq77-gvj7

Multiple Plugins - Cross-Site Scripting From Third-party Library

Priority MEDIUM 60

The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01244 Published 2023-07-10 Fixed in 3.2.13, 2.4.1
TI-2025-03494 CVE-2025-3951 · GHSA-cwjc-83cr-56p7

WP-Optimize < 4.2.0 - Admin+ SQLi

Priority MEDIUM 52

The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the cont…

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.0033 Published 2025-06-02 Fixed in 4.2.0 CWE-89
Open these records in search →