Vulnerabilities

TI-2026-36221 CVE-2026-48965 · GHSA-jvmc-v9mp-529c

WordPress XCloner plugin <= 4.8.6 - Sensitive Data Exposure vulnerability

LOW 35

Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00326 Published 2026-06-15 No fix listed CWE-201

TI-2025-10780 CVE-2025-11759 · GHSA-vvm8-x223-29qp

Cross-site request forgery in watchful Backup, Restore and Migrate your sites with XCloner

LOW 19

The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.2.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00133 Published 2025-12-05 No fix listed CWE-352

TI-2024-06082 CVE-2024-6559 · GHSA-gg88-333c-97wf

XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure

LOW 30

The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00373 Published 2024-07-16 No fix listed CWE-200

TI-2022-00367 CVE-2022-0444 · GHSA-c7r4-v2h5-45gx

XCloner < 4.3.6 - Plugin Settings Reset

LOW 20

The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset t…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00294 Published 2022-06-27 Fixed in 4.3.6 CWE-352

Vulnerabilities

Filters

WordPress XCloner plugin <= 4.8.6 - Sensitive Data Exposure vulnerability

Cross-site request forgery in watchful Backup, Restore and Migrate your sites with XCloner

XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure

XCloner < 4.3.6 - Plugin Settings Reset