Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: WebToffee Component: Backup And Migration Clear all filters
TI-2023-05277 CVE-2023-5738 · GHSA-mgqv-g9mm-hg88

WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSS

Priority LOW 25

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00426 Published 2023-11-27 Fixed in 1.4.4 CWE-79
TI-2023-05276 CVE-2023-5737 · GHSA-px94-47v9-w45x

WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update

Priority LOW 20

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00454 Published 2023-11-27 Fixed in 1.4.4 CWE-862