WordPress Plugin Vulnerabilities

Backup Migration < 1.1.6 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
backup-backup
Fixed in 1.1.6

References

CVE
CVE-2021-36884

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.8 (medium)

Miscellaneous

Original Researcher
Vlad Visse
Verified
No
WPVDB ID
42a9a61d-27e8-4bba-a35a-189ca388a37d

Timeline

Publicly Published
2021-11-17 (about 4 years ago)
Added
2021-11-21 (about 4 years ago)
Last Updated
2022-04-11 (about 4 years ago)

Other

Published
Title
Published
2025-10-21
Title
Welcart e-Commerce < 2.11.23 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail
Published
2025-01-24
Title
ShMapper by Teplitsa < 1.5.1 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2024-03-25
Title
Web Icons < 1.0.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2023-08-11
Title
Stock Ticker < 3.23.4 - Reflected XSS
Published
2025-08-11
Title
Simple Responsive Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting