Security readout for executives and security teams
Plain-English summary
A logged-in WordPress user with access to the plugin’s backup recipient setting could store script that later runs in another user’s browser. This is mainly a web administration risk, not a direct server takeover based on the supplied sources.
Executive priority
Prioritize remediation where the plugin is installed on production WordPress sites, especially sites with multiple administrators or delegated content teams. Urgency is moderate because exploitation requires authentication based on current evidence.
Technical view
The plugin failed to escape the backup_recipient POST parameter before placing it into an HTML tag attribute, causing authenticated stored XSS (CWE-79). The affected range is described as Database Backup for WordPress before 2.4.
Likely exposure
Exposure is limited to WordPress sites running Database Backup for WordPress versions earlier than 2.4. The supplied evidence does not define required WordPress roles, CPEs, internet exposure, or default configuration impact.
Exploitation context
The source bundle does not report active exploitation, and KEV is false. Public references document the vulnerability, so defenders should treat it as disclosed but not as confirmed exploited from these sources.
Researcher notes
The key data-flow issue is unsanitized backup_recipient input being persisted and returned in an HTML attribute. Sources do not provide CVSS, role requirements, affected WordPress versions, or confirmed exploitation telemetry.
Mitigation direction
- Upgrade Database Backup for WordPress to version 2.4 or later.
- Check vendor or WPScan guidance for any additional remediation notes.
- Restrict access to backup plugin settings to trusted administrators.
- Review saved backup recipient settings for unexpected markup or script content.
Validation and detection
- Inventory WordPress sites for the Database Backup for WordPress plugin.
- Confirm installed plugin versions are 2.4 or later.
- Review who can modify the plugin’s backup recipient setting.
- Inspect recent plugin configuration changes for suspicious values.
- Check administrative activity logs around backup settings where available.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-24322 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/6bea6301-0762-45c3-a4eb-15d6ac4f9f37CVE reference · x_refsource_CONFIRM
- https://m0ze.ru/vulnerability/%5B2021-04-04%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-DB-Backup-WordPress-Plugin-v2.3.3.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.