CVE-2022-0864

MEDIUM 6.1CVE-2022-0864 · Published 04/04/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
updraftplus updraftplus	`< 1.22.9`	`1.22.9`

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

References

packetstormsecurity.com/files/166631/WordPress-UpdraftPlus-Cross-Site-Scripting.html · Exploit
wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free