Reflected cross-site scripting in multiple remote storage modules

Multiple remote storage modules in UpdraftPlus did not properly escape output before rendering in HTML. Affected files include the S3, OpenStack

base, template, and insufficient PHP handlers. User-controllable data such as CSS classes, URLs, storage method names, error messages, exception details, HTTP

response codes, and PHP version information were echoed directly without sanitization. This could allow attackers to inject malicious scripts via crafted

input or error responses, potentially leading to script execution in the administrator’s browser.

This vulnerability affects the following application versions:

• UpdraftPlus: WordPress Backup & Migration Plugin 1.22.24
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.1
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.2
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.3
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.4
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.5
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.6
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.7
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.8
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.9
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.10
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.11
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.12
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.13
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.15
• UpdraftPlus: WordPress Backup & Migration Plugin 1.23.16
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.1
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.2
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.3
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.4
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.5
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.6
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.7
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.8
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.9
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.10
• UpdraftPlus: WordPress Backup & Migration Plugin 1.24.11