CVE-2021-24423: Updraftplus

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue

Affected products

• Updraftplus Updraftplus: before 1.16.59 (fixed in 1.16.59)

Published 2022-01-24. Last modified 2026-06-17.