backup-guard vulnerabilities

Products

• backup guard 3

Latest backup-guard CVEs

Newest publication first

1. CVE-2021-24155 Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload

   Published 2021-04-05

   High·CVSS 7.2 EPSS 83.7% Framework module Public exploit

   The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.

2. CVE-2017-18488 Backup Guard <= 1.1.46 - Cross-Site Scripting

   Published 2019-08-13

   Medium·CVSS 6.1 EPSS 0.92%

   The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.

3. CVE-2017-10837 BackupGuard <= 1.1.46 - Reflected Cross-Site Scripting

   Published 2017-08-28

   Medium·CVSS 6.1 EPSS 0.92%

   Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.