WordPress Plugin Vulnerabilities

UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Proof of Concept

Affects Plugins

Plugin icon
updraftplus
Fixed in 1.22.9

References

CVE
CVE-2022-0864

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Taurus Omar
Submitter
Taurus Omar
Submitter website
https://taurusomar.com
Submitter twitter
taurusomar_
Verified
Yes
WPVDB ID
7337543f-4c2c-4365-aebf-3423e9d2f872

Timeline

Publicly Published
2022-03-10 (about 3 years ago)
Added
2022-03-10 (about 3 years ago)
Last Updated
2022-04-17 (about 3 years ago)

Other

Published
Title
Published
2015-02-23
Title
EZ Portfolio <= 1.0.1 - Multiple Cross-Site Scripting (XSS)
Published
2025-08-19
Title
Terms of Service & Privacy Policy Generator <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-01-11
Title
WP Show Posts < 1.1.4 - Contributor+ Stored XSS
Published
2022-05-12
Title
WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting
Published
2023-05-22
Title
Contact Form Entries < 1.3.1 - Contributor+ Stored XSS