CVE-2022-4897

Deeper analysis

The BackupBuddy WordPress plugin before version 8.8.3 contains a reflected cross-site scripting vulnerability. The flaw stems from insufficient sanitization and escaping of certain parameters that are later reflected in plugin output, allowing attacker-controlled content to execute in a victim's browser. It carries a CVSS 3.1 score of 6.1 with an attack vector of network, low complexity, no privileges required, and required user interaction.

An unauthenticated remote attacker can exploit the issue by crafting a malicious link or request that is clicked by an authenticated user with access to the plugin's administrative pages. Successful exploitation can result in the attacker executing arbitrary scripts in the context of the victim's session, potentially leading to theft of cookies, session hijacking, or other actions within the WordPress site.

The referenced WPScan advisory identifies the affected versions and confirms the vulnerability is resolved by updating to BackupBuddy 8.8.3 or later, which implements proper input sanitization and output encoding for the affected parameters.

The EPSS score for this CVE stands at 0.2168 with no material increase from its recorded peak.