CVE-2025-0215: UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiaterestore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0215?
CVE-2025-0215 is rated as a medium severity vulnerability due to its impact on application security through reflected cross-site scripting.
How do I fix CVE-2025-0215?
To fix CVE-2025-0215, update the UpdraftPlus: WP Backup & Migration Plugin to version 1.24.13 or later, which contains the necessary security patches.
What are the vulnerable parameters in CVE-2025-0215?
The vulnerable parameters in CVE-2025-0215 are 'showdata' and 'initiate_restore', which lack sufficient input sanitization and output escaping.
Which versions are affected by CVE-2025-0215?
CVE-2025-0215 affects all versions of the UpdraftPlus: WP Backup & Migration Plugin up to and including version 1.24.12.
What type of attack is possible due to CVE-2025-0215?
CVE-2025-0215 allows for reflected cross-site scripting attacks, potentially enabling attackers to execute malicious scripts in the context of a user’s browser.