Plugin icon

UpdraftPlus: WP Backup & Migration Plugin

updraftplus

Vulnerabilities:

13

Last Updated:

January 19, 2026

Active Installs:

3000000

Published
Title
Fixed in
CVSS
Published
2025-01-15
Title
UpdraftPlus - Backup/Restore < 1.25.1 - Reflected XSS
Fixed in
Fixed in 1.25.1
CVSS
7.1 (high)
Published
2025-01-03
Title
UpdraftPlus < 1.24.12 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.24.12
CVSS
7.5 (high)
Published
2023-11-07
Title
UpdraftPlus: WordPress Backup & Migration < 1.23.11 - Google Drive Storage Update via CSRF
Fixed in
Fixed in 1.23.11
CVSS
5.4 (medium)
Published
2023-05-18
Title
UpdraftPlus < 1.23.4 - CSRF
Fixed in
Fixed in 1.23.4
CVSS
5.8 (medium)
Published
2022-03-10
Title
UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.22.9
CVSS
6.5 (medium)
Published
2022-02-17
Title
UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup Download
Fixed in
Fixed in 1.22.3
CVSS
8.5 (high)
Published
2021-12-28
Title
UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.16.69
CVSS
7.5 (high)
Published
2021-12-06
Title
UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.16.66
CVSS
7.5 (high)
Published
2021-07-12
Title
UpdraftPlus < 1.16.59 - Admin+ Local File Inclusion
Fixed in
Fixed in 1.16.59
CVSS
6.8 (medium)
Published
2021-05-09
Title
UpdraftPlus < 1.6.59 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.6.59
CVSS
3.4 (low)
Published
2017-08-08
Title
Updraftplus < 1.13.5 - XSS
Fixed in
Fixed in 1.13.5
CVSS
6.1 (medium)
Published
2015-04-20
Title
Updraftplus < 1.9.64 - XSS
Fixed in
Fixed in 1.9.64
CVSS
6.1 (medium)
Published
2015-02-03
Title
UpdraftPlus <= 1.9.50 - Privilege Escalation via Nonce Leakage
Fixed in
Fixed in 1.9.51
CVSS
n/a