Reflected Cross-Site Scripting in UpdraftPlus Restore Page

The UpdraftPlus restore page echoed the attacker-supplied updraft_restore parameter into the page without escaping. An unauthenticated attacker who lures an administrator into a crafted request can run script in their browser. Fixed in 1.16.69.

This vulnerability affects the following application versions:

• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.13
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.14
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.15
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.16
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.17
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.20
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.21
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.22
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.23
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.24
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.25
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.26
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.28
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.29
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.32
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.34
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.35
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.36
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.37
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.40
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.41
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.42
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.43
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.44
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.45
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.46
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.47
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.48
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.49
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.50
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.51
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.53
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.55
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.56
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.59
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.60
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.61
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.62
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.63
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.64
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.65
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.66
• UpdraftPlus: WordPress Backup & Migration Plugin 1.16.67