CVE-2022-0531 WPvivid Backup and Migration Plugin < 0.9.70 - Reflected Cross-Site Scripting

What is CVE-2022-0531?

CVE-2022-0531 is a medium-severity cross-site scripting vulnerability in Unknown Migration, Backup, Staging – WPvivid, published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting

Weakness: CWE-79

Which versions are affected by CVE-2022-0531?

It affects 1 product.

Products include Wpvivid Migration\, Backup\, Staging.

How do I fix CVE-2022-0531?

No fix has been published for CVE-2022-0531 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-0531 being exploited?

There is no known exploitation of CVE-2022-0531 in the wild and no public exploit code.

Other vulnerabilities in Unknown Migration, Backup, Staging – WPvivid

• CVE-2024-1981 SQL injection in Migration, Backup, Staging – WPvivid Critical 9.8
• CVE-2024-10962 Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection High 8.8
• CVE-2020-36842 Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload High 8.8
• CVE-2023-41243 WordPress WPvivid Backup Plugin plugin <= 0.9.90 - Privilege Escalation on Staging Environment vulnerability High 8.8
• CVE-2023-4274 Path traversal in Migration, Backup, Staging – WPvivid High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4c64-f2jv-qvwh.