CVE-2022-0864

MEDIUMNuclei

UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0864 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

UpdraftPlus WordPress Backup Plugin

CVE List1.22.9 to < 1.22.9affected

Nuclei templates

1
ProjectDiscoveryMEDIUMUpdraftPlus < 1.22.9 - Cross-Site ScriptingCVSS 6.1

The plugin does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement.

Remediation

Update UpdraftPlus plugin to version 1.22.9 or later to mitigate the vulnerability.

WeaknessesCWE-79
AuthorsDhiyaneshDk
Template tagswpscancvecve2022xssauthenticatedupdraftpluswp-pluginwpwordpressvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:updraftplus:updraftplus:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0864 https://wordpress.org/plugins/updraftplus https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3