6.1 Medium

CVE-2021-25022 The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the…

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues

Affected products and versions

Product	Affected versions	Fixed in
UpdraftPlus WordPress Backup Plugin 1.16	earliest → < 1.16.66	1.16.66

The 4 CVEs of UpdraftPlus WordPress Backup Plugin →

CVE-2022-0864 The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval… Not rated CVE-2021-25089 The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore… Not rated CVE-2021-24423 The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings,… Not rated

Do you use UpdraftPlus WordPress Backup Plugin?

Track this CVE Watch UpdraftPlus WordPress Backup Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2021-25022

Timeline

Published January 3, 2022
Last modified May 22, 2025

References

wpscan.com wpscan.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE

CVE-2021-25022 The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the…

Description

Affected products and versions

Other CVEs of UpdraftPlus WordPress Backup Plugin