What’s Vulnerable › Vulnerabilities

CVE-2020-35950

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-01-01 · updated 2026-06-17
• Weakness: CWE-352

Description

An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint).

Affected products

• Xcloner: before 4.2.153 — fixed in 4.2.153

How to fix

Upgrade to a fixed version: Xcloner 4.2.153. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/10413
• https://www.wordfence.com/blog/2020/09/critical-vulnerabilities-patched-in-xcloner-backup-and-restore-plugin/
• https://wpscan.com/vulnerability/10413
• https://www.wordfence.com/blog/2020/09/critical-vulnerabilities-patched-in-xcloner-backup-and-restore-plugin/

Get alerted when CVE-2020-35950 or the next vulnerability affects your stack