CVE-2021-24423: UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site Scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-24 · updated 2026-06-17
Weakness: CWE-79

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue

Affected products

UpdraftPlus WordPress Backup Plugin: before 1.16.59 — fixed in 1.16.59

How to fix

Upgrade to a fixed version: UpdraftPlus WordPress Backup Plugin 1.16.59. Check the vendor advisory for mitigations.

References

https://m0ze.ru/vulnerability/%5B2021-05-09%5D-%5BWordPress%5D-%5BCWE-79%5D-UpdraftPlus-WordPress-Plugin-v1.16.56.txt
https://wpscan.com/vulnerability/541974d6-2df8-4497-9aee-afd3b9024102
https://m0ze.ru/vulnerability/%5B2021-05-09%5D-%5BWordPress%5D-%5BCWE-79%5D-UpdraftPlus-WordPress-Plugin-v1.16.56.txt
https://wpscan.com/vulnerability/541974d6-2df8-4497-9aee-afd3b9024102

Get alerted when CVE-2021-24423 or the next vulnerability affects your stack