CVE-2022-0864

Опубликовано: 04 апр. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Ссылки

http://packetstormsecurity.com/files/166631/WordPress-UpdraftPlus-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/166631/WordPress-UpdraftPlus-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:updraftplus:updraftplus:*:*:*:*:*:wordpress:*:*

Версия до 1.22.9 (исключая)

EPSS

Процентиль: 89%

0.04513

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-2pp2-5h73-4wxg