CVE-2022-0864

CVE-2022-0864: UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

Vendor Unknown

Product UpdraftPlus WordPress Backup Plugin

Weakness CWE-79 · XSS

Published April 4, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Key dates

02Disclosure timeline

April 4, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0864 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-22816 WordPress Power Mag theme <= 1.1.5 - Cross Site Scripting (XSS) vulnerability CVE-2024-23868 Cross-Site Scripting (XSS) vulnerability in Cups Easy CVE-2023-2057 EyouCms New Picture cross site scripting CVE-2025-58080 CVE-2026-1083 Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration