PT-2021-21394 · WordPress · Wordpress Backup & Migration

Re-Alter + 1 · Published 2021-11-19 · Updated 2022-01-04 · CVE-2021-36884

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Backup Migration plugin versions <= 1.1.5

Description An Authenticated Persistent Cross-Site Scripting (XSS) issue has been discovered. This allows an attacker to inject malicious scripts into the application, which can lead to unauthorized actions on behalf of the user.

Recommendations For WordPress Backup Migration plugin versions <= 1.1.5, update to a version greater than 1.1.5 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-36884

Affected Products

Wordpress Backup & Migration

References · 5

• https://patchstack.com/database/vulnerability/backup-backup/wordpress-backup-migration-plugin-1-1-5-authenticated-persistent-cross-site-scripting-xss-vulnerability · Patch
• https://osv.dev/vulnerability/CVE-2021-36884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36884 · Security Note
• https://wordpress.org/plugins/backup-backup/#developers · Note
• https://t.me/cibsecurity/32742 · Telegram Post