What is the CVSS score of CVE-2026-3577?

CVE-2026-3577 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3577?

Organizations using all should be aware of moderate risk from CVE-2026-3577, a cross-site scripting vulnerability rated CVSS 4.4.

How to fix or mitigate CVE-2026-3577?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3577

EUVD-2026-13927 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 Wordfence

WordPress XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:46 euvd

EUVD-2026-13927

Analysis Generated

Mar 20, 2026 - 23:46 vuln.today

CVE Published

Mar 20, 2026 - 23:25 nvd

MEDIUM 4.4

DescriptionCVE.org

The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (val parameter) in the update_kbd_bkup_alias AJAX action in all versions up to, and including, 2.1.2. This is due to insufficient input sanitization and output escaping. While sanitize_text_field() strips HTML tags on save, it does not encode double quotes. The backup titles are output in HTML attribute contexts without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via attribute injection that will execute whenever another administrator views the backup list page.

AnalysisAI

The Keep Backup Daily WordPress plugin versions up to 2.1.2 contain a Stored Cross-Site Scripting (XSS) vulnerability in the backup title alias functionality due to insufficient input sanitization and output escaping. Authenticated administrators can inject arbitrary JavaScript via the val parameter in the update_kbd_bkup_alias AJAX action, which executes when other administrators view the backup list page. With a CVSS score of 4.4 and moderate real-world risk due to high privilege requirements, this vulnerability requires administrator-level access to exploit but can compromise other administrator sessions.

Technical ContextAI

The vulnerability stems from improper handling of user input in the Keep Backup Daily plugin (CPE: cpe:2.3:a:fahadmahmood:keep_backup_daily:*:*:*:*:*:*:*:*), classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin uses sanitize_text_field() on the val parameter during the AJAX action update_kbd_bkup_alias, which strips HTML tags but fails to encode double quotes. Critically, the backup title is subsequently rendered in HTML attribute contexts without using WordPress's esc_attr() function. This combination of weak input sanitization (allowing quote characters to pass through) and missing output escaping creates a classic attribute injection vector, allowing attackers to break out of the intended attribute context and inject event handlers or other executable code that executes in the DOM.

RemediationAI

Upgrade the Keep Backup Daily plugin to version 2.1.3 or later, which should address the input sanitization and output escaping issues. Until an update is available or deployable, limit administrator role assignments to only trusted users and implement WordPress user role management to restrict who can access backup functionality. Additionally, enforce strong password policies and enable two-factor authentication on all administrator accounts to reduce the risk of unauthorized administrator access. Monitor the WordPress plugin repository and Wordfence threat intelligence feed for the official patch release at https://www.wordfence.com/threat-intel/vulnerabilities/id/18a4fa4b-5c99-4347-8b34-e49f7e0972be?source=cve.