Show filters
15 Total Results
Displaying 11-15 of 15
Sort by:
Attacker Value
Unknown
CVE-2021-25022
Disclosure Date: January 03, 2022 (last updated February 23, 2025)
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
0
Attacker Value
Unknown
CVE-2017-18593
Disclosure Date: August 28, 2019 (last updated November 27, 2024)
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
0
Attacker Value
Unknown
CVE-2015-9360
Disclosure Date: August 28, 2019 (last updated November 27, 2024)
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
0
Attacker Value
Unknown
CVE-2017-16871
Disclosure Date: November 17, 2017 (last updated November 08, 2023)
The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary
0
Attacker Value
Unknown
CVE-2017-16870
Disclosure Date: November 17, 2017 (last updated November 08, 2023)
The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary
0
