CVE-2021-24423

The UpdraftPlus WordPress Backup Plugin versions before 1.6.59 fail to properly sanitize the updraft_service settings parameter, which permits administrators and other high-privilege users to inject malicious JavaScript code that gets stored in the database. When these settings are later displayed, the stored JavaScript executes in the browsers of users viewing the plugin's settings pages, resulting in a persistent cross-site scripting vulnerability. This flaw allows privileged attackers to compromise the security of the WordPress installation and potentially target other administrators.

Based on public CVE data (MITRE/NVD).