CVE-2021-24423: UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site Scripting
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraftservice settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-24423.
What is the title of the vulnerability?
The title of the vulnerability is 'The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue'.
What is the severity of CVE-2021-24423?
The severity of CVE-2021-24423 is medium (4.8).
How does CVE-2021-24423 affect the UpdraftPlus WordPress Backup Plugin?
CVE-2021-24423 affects the UpdraftPlus WordPress Backup Plugin version 1.6.59 and earlier.
How can the Stored Cross-Site Scripting issue be exploited?
The Stored Cross-Site Scripting issue can be exploited by high privilege users setting a malicious JavaScript payload in the updraft_service settings.