Royal Wordpress Backup Restore Migration Plugin Backup Wordpress Sites Safely
CVE-2026-4305
|
EUVD-2026-21260
MEDIUM
GHSA-pfgm-6jj5-pxw5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_template' parameter in all versions up to, and including, 1.0.16 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting (XSS) in Royal WordPress Backup & Restore Plugin up to version 1.0.16 allows unauthenticated attackers to inject arbitrary JavaScript via the 'wpr_pending_template' parameter. An attacker can craft a malicious link and trick a WordPress administrator into clicking it, causing the injected script to execute in the admin's browser with their privileges. This affects all installations running the vulnerable plugin versions, and no active exploitation has been confirmed, though the low attack complexity and lack of authentication requirements make this a practical threat.
Technical ContextAI
The vulnerability is a Reflected Cross-Site Scripting flaw (CWE-79) in the Royal WordPress Backup & Restore Plugin, a WordPress plugin distributed through the official WordPress plugin repository. The plugin fails to properly validate and sanitize the 'wpr_pending_template' URL parameter before rendering it in web pages. WordPress plugins operate within the WordPress ecosystem as PHP-based extensions that extend site functionality; improper handling of user-supplied input in parameters can lead to script injection when the parameter value is echoed to the page without proper HTML encoding or escaping. The plugin is identified by CPE cpe:2.3:a:wproyal:royal_wordpress_backup,_restore_&_migration_plugin_-_backup_wordpress_sites_safely, indicating it is a WordPress plugin from the vendor 'wproyal'. Code review references from the WordPress plugin repository (tags/1.0.16) indicate the vulnerable code path exists in the plugin's main PHP file and associated JavaScript assets.
RemediationAI
Update the Royal WordPress Backup & Restore Plugin to version 1.0.17 or later immediately. The vendor has released a patched version; administrators should navigate to the WordPress dashboard, go to Plugins, and click 'Update' next to the Royal Backup plugin, or manually update to version 1.0.17 from the WordPress plugin repository. Verify the update completes successfully and the plugin shows version 1.0.17 or higher in the Plugins list. Until patched, limit plugin access to trusted administrators only and educate administrators not to click on suspicious links referencing backup or plugin-related URLs. Full details are available from the Wordfence vulnerability intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e0c658-b37c-4780-9589-6def9e36539b and the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Froyal-backup-reset/tags/1.0.16&new_path=%2Froyal-backup-reset/tags/1.0.17.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today