Multiple cross-site scripting vulnerabilities in plugin admin templates

Multiple Cross-Site Scripting (XSS) vulnerabilities were identified across eight template files in the UpdraftPlus WordPress backup plugin’s admin interface due to insufficient output escaping. These vulnerabilities could allow authenticated attackers with administrative access to inject malicious scripts through various vectors including URLs, form inputs, plugin settings, and dynamic content rendering. Affected components include the premium add-ons page, backup management interface, migration tools, UpdraftCentral connection forms, file upload modals, navigation tabs, and header elements. The vulnerabilities were remediated by implementing proper WordPress escaping functions (esc_url(), esc_html(), esc_attr(), wp_kses(), and wp_kses_post()) throughout all affected template files.

This vulnerability affects the following application versions:

• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.59
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.60
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.61
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.62
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.63
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.64
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.65
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.66
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.67
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.68
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.69
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.1
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.3
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.4
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.5
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.6
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.7
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.8
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.9
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.10
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.11
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.12
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.14
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.15
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.16
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.17
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.18
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.19
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.20
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.21
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.22
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.23
• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.24
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.1
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.2
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.3
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.4
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.5
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.6
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.7
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.8
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.9
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.10
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.11
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.12
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.13
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.15
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.16
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.1
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.2
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.3
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.4
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.5
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.6
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.7
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.8
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.9
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.10
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.11