GCVE - cpe:2.3:a:updraftplus:updraftplus:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:updraftplus:updraftplus:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Updraftplus (`94d7e9af-81e2-5660-a0d0-6c239316da45`)
Product	Updraftplus (`5b253a1b-3f7c-54f5-bfd6-9033af9fc9ca`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/wp-plugins/updraftplus`	purl2cpe	2026-06-01 10:16:47.484262

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-5982`	vulnerable	2026-06-08 06:19:45.307784	UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update MEDIUM (5.4) The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information. Published: 2023-11-07T20:31:56.550Z Updated: 2026-04-08T17:29:02.795Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/e1be11c5-0a44-4816-b6bf-d330cb51dbf3?source=cve https://plugins.trac.wordpress.org/changeset/2989669/updraftplus/tags/1.23.11/class-updraftplus.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-32960`	vulnerable	2026-06-08 06:04:48.060728	WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF) HIGH (7.1) Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS). Published: 2023-06-22T12:51:41.876Z Updated: 2026-04-28T16:08:24.603Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/updraftplus/wordpress-updraftplus-plugin-1-23-3-csrf-lead-to-wp-admin-site-wide-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0864`	vulnerable	2026-06-08 05:39:11.375114	UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability. Published: 2022-04-04T15:35:53.000Z Updated: 2024-08-02T23:40:04.563Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872 http://packetstormsecurity.com/files/166631/WordPress-UpdraftPlus-Cross-Site-Scripting.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25089`	vulnerable	2026-06-08 05:30:39.943537	UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page, leading to a Reflected Cross-Site Scripting Published: 2022-02-01T12:21:37.000Z Updated: 2024-08-03T19:56:10.476Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/5adb977e-f7bf-4d36-b625-87bc23d379c8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25022`	vulnerable	2026-06-08 05:30:39.817320	UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues Published: 2022-01-03T12:49:15.000Z Updated: 2025-05-22T18:40:18.824Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/1801c7ae-2b5c-493f-969d-4bb19a9feb15 https://plugins.trac.wordpress.org/changeset/2635585/updraftplus https://plugins.trac.wordpress.org/changeset/2637112/updraftplus	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24423`	vulnerable	2026-06-08 05:30:04.353615	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-18593`	vulnerable	2026-06-08 05:09:11.293784	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16871`	vulnerable	2026-06-08 05:09:07.487951	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16870`	vulnerable	2026-06-08 05:09:07.487543	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-9360`	vulnerable	2026-06-08 05:07:13.605470	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.