WordPress xcloner has 11 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-35948 | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to | critical | 9.9 | >=4.2.1 and <4.2.13 | 4.2.13 |
| CVE-2014-8604 | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration pane | medium | 5.0 | =3.1.1 | – |
| CVE-2014-8605 | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with ins | medium | 5.0 | =3.1.1 | – |
| CVE-2014-8603 | cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code | medium | 6.5 | =3.1.1 | – |
| CVE-2014-8606 | Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbit | medium | 4.0 | =3.1.1 | – |
| CVE-2015-4336 | cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file co | medium | 6.5 | =3.1.2 | – |
| CVE-2015-4338 | Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code | medium | 6.5 | =3.1.2 | – |
| CVE-2015-4337 | Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web | low | 3.5 | =3.1.2 | – |
| CVE-2020-35950 | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint). | critical | 9.8 | <4.2.153 | 4.2.153 |
| CVE-2014-8607 | The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows loca | low | 2.1 | =3.1.1 | – |
| CVE-2022-0444 | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF c | medium | 4.3 | <4.3.6 | 4.3.6 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked