An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for…
Priority MEDIUM 44CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint).
Why it matters now
EPSS 0.00943 61st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-35950
- 2026-10-03 Alias added: GHSA-48xm-jq3f-3xjx
References
More Xcloner vulnerabilities
- TI-2020-18389 An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for… CVSS 3.1CRITICAL 9.9
- TI-2014-02395 XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows… CVSS 2.0HIGH 7.1
- TI-2014-02066 Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and… CVSS 2.0HIGH 7.6
- TI-2014-07067 cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla!… CVSS 2.0MEDIUM 6.5
- TI-2014-01857 Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for… CVSS 2.0MEDIUM 6.8
- TI-2015-03638 cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote… CVSS 2.0MEDIUM 6.5
Sources
- CVE-2020-35950 · CVE Program
- CVE-2020-35950 · NVD
- FIRST EPSS
- GHSA-48xm-jq3f-3xjx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences