What is the CVSS score of CVE-2026-3577?

CVE-2026-3577 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-3577?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Keep Backup Daily CVE-2026-3577

EUVD-2026-13927 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 Wordfence

WordPress XSS Keep Backup Daily Wordpress Plugin Fahadmahmood

4.4

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	While the CVSS 3.1 base score of 4.4 appears moderate, the real-world risk is constrained by multiple factors evident in the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N). The attack requires high privileges (PR:H, administrator-level access) and high attack complexity (AC:H), significantly reducing the practical threat surface. However, the vulnerability is a Stored XSS affecting another user (scope change: S:C), meaning an administrator attacker can compromise peer administrators without requiring them to click a malicious link. The absence of availability impact (A:N) and confidentiality/integrity impact limited to low (C:L/I:L) further supports a medium-risk classification rather than critical. No EPSS score, KEV status, or public POC is noted in the intelligence, suggesting this is not currently under active exploitation. The primary risk scenario involves a malicious administrator with legitimate access—a threat model many organizations already mitigate through administrator access controls.
Exploit ScenarioDerived	A malicious administrator with legitimate access to the WordPress dashboard navigates to the backup management page and injects a payload such as `test" onmouseover="alert('XSS')` into the backup title alias field via the AJAX endpoint. When a peer administrator later views the backup list page, the unescaped double quote breaks out of the HTML attribute context, and the injected `onmouseover` event handler executes, allowing the attacker to steal session tokens, modify backup configurations, or perform other administrative actions within the victim administrator's session. No user interaction beyond viewing the backup list is required (UI:N in CVSS), making this a direct attribute injection attack executable through DOM manipulation.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 20, 2026

The Keep Backup Daily WordPress plugin versions up to 2.1.2 contain a Stored Cross-Site Scripting (XSS) vulnerability in the backup title alias functionality due to insufficient input sanitization and output escaping. Authenticated administrators can inject arbitrary JavaScript via the val parameter in the update_kbd_bkup_alias AJAX action, which executes when other administrators view the backup list page. With a CVSS score of 4.4 and moderate real-world risk due to high privilege requirements, this vulnerability requires administrator-level access to exploit but can compromise other administrator sessions.

RemediationAI

Upgrade the Keep Backup Daily plugin to version 2.1.3 or later, which should address the input sanitization and output escaping issues. Until an update is available or deployable, limit administrator role assignments to only trusted users and implement WordPress user role management to restrict who can access backup functionality. Additionally, enforce strong password policies and enable two-factor authentication on all administrator accounts to reduce the risk of unauthorized administrator access. Monitor the WordPress plugin repository and Wordfence threat intelligence feed for the official patch release at https://www.wordfence.com/threat-intel/vulnerabilities/id/18a4fa4b-5c99-4347-8b34-e49f7e0972be?source=cve.

Affected VersionsENISA

Keep Backup Daily * ≤2.1.2

Affected Packages

euvd keep_backup_daily no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability stems from improper handling of user input in the Keep Backup Daily plugin (CPE: cpe:2.3:a:fahadmahmood:keep_backup_daily:*:*:*:*:*:*:*:*), classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin uses sanitize_text_field() on the val parameter during the AJAX action update_kbd_bkup_alias, which strips HTML tags but fails to encode double quotes. Critically, the backup title is subsequently rendered in HTML attribute contexts without using WordPress's esc_attr() function. This combination of weak input sanitization (allowing quote characters to pass through) and missing output escaping creates a classic attribute injection vector, allowing attackers to break out of the intended attribute context and inject event handlers or other executable code that executes in the DOM.

Know when Keep Backup Daily gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionCVE.org

The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (val parameter) in the update_kbd_bkup_alias AJAX action in all versions up to, and including, 2.1.2. This is due to insufficient input sanitization and output escaping. While sanitize_text_field() strips HTML tags on save, it does not encode double quotes. The backup titles are output in HTML attribute contexts without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via attribute injection that will execute whenever another administrator views the backup list page.

Executive ViewAI

Why It Matters

Organizations using all should be aware of moderate risk from CVE-2026-3577, a cross-site scripting vulnerability rated CVSS 4.4. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.