Vulnerability · Published Feb 21, 2023 · Assigned by WPScan

CVE-2022-4897BackupBuddy < 8.8.3 - Multiple Reflected Cross-Site Scripting

Medium 6.1

In plain English

A medium-severity security flaw in BackupBuddy from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting

Affected products (as reported)

Vendor	Product	Versions
Unknown	BackupBuddy	0 – before 8.8.3

References

https://wpscan.com/vulnerability/7b0eeafe-b9bc-43b2-8487-a23d3960f73f exploit, vdb-entry, technical-description