CVE-2021-25022

MEDIUM 6.1CVE-2021-25022 · Published 03/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
updraftplus updraftplus	`< 1.16.66`	`1.16.66`

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues

References

plugins.trac.wordpress.org/changeset/2635585/updraftplus · Patch
plugins.trac.wordpress.org/changeset/2637112/updraftplus · Patch
wpscan.com/vulnerability/1801c7ae-2b5c-493f-969d-4bb19a9feb15 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free