CVE-2022-0864: UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting
Published Apr 4, 2022
·Updated
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
Affected Software
1 affected component
updraftplus UpdraftPlus WordPress<1.22.9
Event History
Apr 4, 2022
CVE Published
via MITRE·03:35 PM
Data Sourced
via MITRE·03:35 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the UpdraftPlus WordPress Backup Plugin WordPress plugin?
The vulnerability ID for the UpdraftPlus WordPress Backup Plugin WordPress plugin is CVE-2022-0864.
2
What is the severity of CVE-2022-0864?
The severity of CVE-2022-0864 is medium with a CVSS score of 6.1.
3
How does CVE-2022-0864 affect the UpdraftPlus WordPress Backup Plugin?
CVE-2022-0864 affects the UpdraftPlus WordPress Backup Plugin version 1.22.9 and earlier.
4
What is the CWE ID for CVE-2022-0864?
The CWE ID for CVE-2022-0864 is CWE-79.
5
How can I fix CVE-2022-0864?
To fix CVE-2022-0864, update the UpdraftPlus WordPress Backup Plugin to version 1.22.9 or later.