UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2022-0864

UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

Severity
Medium 6.1
Published
10 Mar 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.22.9
Also known as
WPV-f046d3a71e6c
Sources
NVD, WPVulnerability

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Affected software

SoftwareAffected versions
UpdraftPlusServers and applications · cpe:a:updraftplus:updraftplus
  • Every version before 1.22.9
UpdraftPlusWordPress plugins · wp-plugin:updraftplus
  • Every version before 1.22.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-0864
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-0864
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus/updraftplus-wordpress-backup-plugin-1229-reflected-cross-site-scripting