WPvivid — Backup, Migration & Staging

89 Quality Score

Active Installs

27/30

With 900,000 active installs and a popularity score of 89/30, WPvivid has a substantial user base, though it sits well behind UpdraftPlus (3 million) and All-in-One WP Migration (5 million).

Update Freshness

25/25

The plugin was updated on 2026-07-09, just days before this assessment, and earns a perfect 100/25 maintenance score, indicating very active development.

User Rating

15/15

A 98/100 average from 1,508 reviews is exceptionally strong and reflects consistently positive user experiences across a large sample.

Support Health

8/15

Support threads are scarce at only 6 total, all resolved, which yields a moderate 50/15; this could indicate either few problems or a small community discussion footprint relative to install count.

WP Compatibility

15/15

Tested against WordPress 7.0.1 and requiring only WordPress 4.5 and PHP 5.3, it scores a full 100/15 and runs on virtually any WordPress environment.

Scores higher than 99% of indexed plugins

About

All-in-one WordPress backup, migration and staging plugin — schedule automatic backups, restore in one click, and migrate or clone sites safely.

Active Installs 900k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-10 12:26am GMT

Requires WordPress 4.5+

Tested Up To 7.1

Requires PHP 5.3+

Security History

33 known vulnerabilities, all patched

2 Critical 13 High 16 Medium 2 Low

Most recent: September 2, 2026

View details ▸

WPvivid — Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Deletion Medium

September 2, 2026 Patched in ["0.9.134"] CVE-2026-82194

WPvivid — Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Upload High

September 2, 2026 Patched in ["0.9.134"] CVE-2026-82193

WPvivid — Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) SQL Injection Medium

September 2, 2026 Patched in ["0.9.133"] CVE-2026-82182

WPvivid — Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) Remote Code Execution High

August 30, 2026 Patched in ["0.9.133"] CVE-2026-19722

WPvivid — Backup, Migration & Staging < 0.9.131 - Unauthenticated Path Traversal High

August 20, 2026 Patched in ["0.9.131"] CVE-2026-19725

WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter Medium

July 31, 2026 Patched in ["0.9.132"] CVE-2026-17555

Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion Low

June 5, 2026 Patched in ["0.9.129"] CVE-2025-12656

Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload Critical

February 10, 2026 Patched in ["0.9.124"] CVE-2026-1357

Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation Low

December 20, 2025 Patched in ["0.9.121"] CVE-2025-12654

Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload High

July 3, 2025 Patched in ["0.9.117"] CVE-2025-5961

Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file High

February 21, 2025 Patched in ["0.9.113"] CVE-2024-13869

WPvivid Backup and Migration <= 0.9.106 - Missing Authorization Medium

January 3, 2025 Patched in ["0.9.107"] CVE-2024-56273

Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection High

November 13, 2024 Patched in ["0.9.108"] CVE-2024-10962

Migration, Backup, Staging – WPvivid <= 0.9.105 - Sensitive Information Exposure High

September 11, 2024 Patched in ["0.9.106"] CVE-2024-7315

WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization High

April 11, 2024 Patched in ["0.9.100"] CVE-2024-3054

WPvivid Backup and Migration <= 0.9.68 - Missing Authorization Medium

February 28, 2024 Patched in ["0.9.69"] CVE-2024-1982

WPvivid Backup and Migration <= 0.9.68 - Unauthenticated SQL Injection Critical

February 28, 2024 Patched in ["0.9.69"] CVE-2024-1981

WPvivid <= 0.9.94 - Missing Authorization Medium

January 19, 2024 Patched in ["0.9.95"] CVE-2023-4637

Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure High

October 13, 2023 Patched in ["0.9.92"] CVE-2023-5576

Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated Stored Cross-Site Scripting Medium

September 22, 2023 Patched in ["0.9.90"] CVE-2023-5120

Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal High

September 22, 2023 Patched in ["0.9.90"] CVE-2023-4274

Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

September 22, 2023 Patched in ["0.9.90"] CVE-2023-5121

WPvivid Backup Plugin <= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress' High

September 12, 2023 Patched in ["0.9.91"] CVE-2023-41243

WPvivid Backup 0.9.76 - Authenticated (Administrator+) Arbitrary File Deletion Medium

August 29, 2022 Patched in ["0.9.77"]

Migration, Backup, Staging – WPvivid <= 0.9.75 - Authenticated (Administrator+) Path Traversal Medium

August 22, 2022 Patched in ["0.9.76"] CVE-2022-2863

Migration, Backup, Staging – WPvivid <= 0.9.75 - Authenticated (Admin+) Directory Traversal Medium

August 16, 2022 Patched in ["0.9.76"]

Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization High

August 10, 2022 Patched in ["0.9.75"] CVE-2022-2442

Migration, Backup, Staging – WPvivid <= 0.9.70 - Authenticated Arbitrary File Read Medium

April 7, 2022 Patched in ["0.9.71"] CVE-2022-27844

Migration, Backup, Staging – WPvivid <= 0.9.69 - Reflected Cross-Site Scripting via sub_page Parameter Medium

March 21, 2022 Patched in ["0.9.70"] CVE-2022-0531

Migration, Backup, Staging – WPvivid <= 0.9.68 - Unauthenticated Stored Cross-Site Scripting Medium

January 31, 2022 Patched in ["0.9.69"] CVE-2021-24994

Migration, Backup, Staging – WPvivid <= 0.9.55 - Reflected Cross-Site Scripting Medium

August 9, 2021 Patched in ["0.9.56"]

Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure Medium

March 23, 2020 Patched in ["0.9.36"] CVE-2020-36835

Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload High

March 13, 2020 Patched in ["0.9.36"] CVE-2020-36842

What It Does

WPvivid creates full backups of your WordPress site, including files and database, on a schedule you control. It also handles one-click restores, site migrations to new hosts or domains, and staging environments for testing changes safely. Backups can be stored locally or sent to remote destinations like Google Drive, Dropbox, Amazon S3, or SFTP.

Who It's For

This plugin fits site owners who want a single tool for backups, migrations, and staging without paying for a premium add-on tier for basic features. It works well for freelancers and small agencies that clone or migrate client sites frequently and need a reliable, low-cost workflow. Anyone running WordPress 4.5 or higher on PHP 5.3+ can install it with no compatibility worries.

Who Should Skip It

If you already use a managed WordPress host that handles daily backups and one-click restores (such as Kinsta, WP Engine, or SiteGround), this plugin adds redundancy without much benefit. Enterprise sites with strict compliance requirements should consider Jetpack Backup (VaultPress) or a dedicated backup service with signed audit trails.

The Bottom Line

WPvivid delivers a strong all-in-one backup, migration, and staging experience with top-tier ratings, recent updates, and broad compatibility, making it a sensible pick for most WordPress site owners. Its overall quality score of 88.86/100 is solid, though it trails UpdraftPlus (98.41) and All-in-One WP Migration (97.85) in overall ranking. If you need one free plugin that handles all three core site-management tasks without upsells, WPvivid is worth installing.

Pick UpdraftPlus if you want the most established free backup plugin with a longer track record, larger install base (3 million), and a mature ecosystem of premium add-ons.

All-in-One WP Migration and Backup 98/100

Choose All-in-One WP Migration if your primary need is moving sites between hosts with minimal configuration, and you do not need scheduled backups or staging.

Yoast Duplicate Post 98/100

Pick Yoast Duplicate Post if you only need to duplicate individual posts or pages for content workflows rather than full site backups or migrations.

Duplicator – Backups & Migration Plugin 95/100

Choose Duplicator if you want package-based site moves with manual control over what gets included and excluded in each archive.

Jetpack 93/100

Pick Jetpack if you want backups bundled into a broader toolkit that also covers security, performance, and growth features on a single subscription.