Vulnerabilities

TI-2025-20899 CVE-2025-28956 · GHSA-ff9g-wp3c-hr83

WordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphobby Backwp backwp allows Reflected XSS.This issue affects Backwp: from n/a through <= 2.0.2.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00252 Published 2025-06-27 No fix listed CWE-79

TI-2025-20897 CVE-2025-28954 · GHSA-frv7-wqrj-85p7

WordPress Backwp plugin <= 2.0.2 - CSRF to Arbitrary File Deletion vulnerability

LOW 32

Cross-Site Request Forgery (CSRF) vulnerability in wphobby Backwp backwp allows Path Traversal.This issue affects Backwp: from n/a through <= 2.0.2.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00196 Published 2025-06-06 No fix listed CWE-352

TI-2024-12674 CVE-2024-13634 · GHSA-jcm8-5j7x-8gjh

Post Sync <= 1.1 - Reflected XSS

MEDIUM 60

The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00621 Published 2025-02-26 No fix listed CWE-79

Vulnerabilities

Filters

WordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress Backwp plugin <= 2.0.2 - CSRF to Arbitrary File Deletion vulnerability

Post Sync <= 1.1 - Reflected XSS