UpdraftPlus WordPress Backup Plugin Vulnerability

That – https://ithemes.com/blog/wordpress-vulnerability-report-april-26-2023/#vulnerability-11371 – is *Updraft*, not *UpdraftPlus*.

Updraft – https://wordpress.org/plugins/updraft/ – is a plugin that was last updated 12 years ago (2011), for WordPress 3.1. Last time I looked at it a few years ago, it didn’t even load on any modern WordPress version (it pre-dates the release of PHP 5.3 !).

In my view it’s somewhat irresponsible of people to publish things like that without clarification. On further investigation, it looks like a Patchstack researcher first published it – https://patchstack.com/database/vulnerability/updraft/wordpress-updraft-plugin-0-6-1-cross-site-scripting-xss-vulnerability . Weird.