CVE-2021-25022: UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-03 · updated 2026-06-17
Weakness: CWE-79

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues

Affected products

UpdraftPlus WordPress Backup Plugin: before 1.16.66 — fixed in 1.16.66

How to fix

Upgrade to a fixed version: UpdraftPlus WordPress Backup Plugin 1.16.66. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2635585/updraftplus
https://plugins.trac.wordpress.org/changeset/2637112/updraftplus
https://wpscan.com/vulnerability/1801c7ae-2b5c-493f-969d-4bb19a9feb15
https://plugins.trac.wordpress.org/changeset/2635585/updraftplus
https://plugins.trac.wordpress.org/changeset/2637112/updraftplus
https://wpscan.com/vulnerability/1801c7ae-2b5c-493f-969d-4bb19a9feb15

Get alerted when CVE-2021-25022 or the next vulnerability affects your stack