CVE-2021-24994: Wpvivid Migration, Backup, Staging

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue

Affected products

• Wpvivid Migration, Backup, Staging: before 0.9.69 (fixed in 0.9.69)

Published 2022-02-28. Last modified 2026-06-17.