CVE-2022-0864: UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-04 · updated 2026-06-17
Weakness: CWE-79

Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Affected products

UpdraftPlus WordPress Backup Plugin: before 1.22.9 — fixed in 1.22.9

How to fix

Upgrade to a fixed version: UpdraftPlus WordPress Backup Plugin 1.22.9. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/166631/WordPress-UpdraftPlus-Cross-Site-Scripting.html
https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872
http://packetstormsecurity.com/files/166631/WordPress-UpdraftPlus-Cross-Site-Scripting.html
https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872

Get alerted when CVE-2022-0864 or the next vulnerability affects your stack