WordPress XCloner plugin versions 3.1.5 and below suffer from remote command execution and denial of service vulnerabilities.