Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-0864

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

6.1MEDIUM

EPSS

4.1%

top 11.34%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Unknown Updraftplus Wordpress Backup Plugin Updraftplus Updraftplus

Timeline

PublishedApr 4

Latest updateApr 5

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/updraftplus_wordpress_backup_plugin1.22.9 — 1.22.9

▶NVDupdraftplus/updraftplus< 1.22.9

🔴Vulnerability Details

GHSA

GHSA-2pp2-5h73-4wxg: The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1↗2022-04-05

▶

CVEList

UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting↗2022-04-04

▶

💥Exploits & PoCs

Nuclei

UpdraftPlus < 1.22.9 - Cross-Site Scripting

▶