The vulnerability is a reflected Cross‑Site Scripting flaw caused by insufficient input sanitization and output escaping in the showdata and initiate_restore parameters of the UpdraftPlus plugin. An attacker can craft a malicious URL that includes arbitrary JavaScript, which will be re‑inserted into the page when an administrator clicks the link. The injected script runs with the privileges of the logged‑in admin, potentially allowing the attacker to manipulate the page or perform actions while the admin is logged in.

Vulnerable versions are all releases of UpdraftPlus WP Backup & Migration Plugin up to and including 1.24.12, as provided by the vendor David Anderson. Any WordPress site that has installed or is currently running any of these affected releases is at risk.

The CVSS score of 6.1 reflects a moderate risk, and an EPSS score of <1% indicates a low probability of widespread exploitation at this time. The issue is not listed in CISA's KEV catalog. Exploitation requires only that an admin user visits a specially crafted link; no authentication is needed and the attack vector is primarily social engineering. Because the injected code runs in the administrator's session, the consequences can be significant for confidentiality and integrity while the admin is logged in.