CVE-2021-24322
Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS)
CVE-2021-24322 is a medium vulnerability (CVSS 5.4) in Delicious Brains Database Backup For Wordpress, published June 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. No source names a fixed version.
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
- Record
CVE-2021-24322- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS)
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
- Record
CVE-2021-24322- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-11236 No score
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
- Record
EUVD-2021-11236- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4737-m2m8-j7xf No score
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST...
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
- Record
GHSA-4737-m2m8-j7xf- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |