What is the CVSS score of CVE-2026-4305?

CVE-2026-4305 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4305

EUVD-2026-21260 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 Wordfence

GHSA-pfgm-6jj5-pxw5

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21260

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:25 nvd

MEDIUM 6.1

DescriptionCVE.org

The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_template' parameter in all versions up to, and including, 1.0.16 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting (XSS) in Royal WordPress Backup & Restore Plugin up to version 1.0.16 allows unauthenticated attackers to inject arbitrary JavaScript via the 'wpr_pending_template' parameter. An attacker can craft a malicious link and trick a WordPress administrator into clicking it, causing the injected script to execute in the admin's browser with their privileges. This affects all installations running the vulnerable plugin versions, and no active exploitation has been confirmed, though the low attack complexity and lack of authentication requirements make this a practical threat.

Technical ContextAI

The vulnerability is a Reflected Cross-Site Scripting flaw (CWE-79) in the Royal WordPress Backup & Restore Plugin, a WordPress plugin distributed through the official WordPress plugin repository. The plugin fails to properly validate and sanitize the 'wpr_pending_template' URL parameter before rendering it in web pages. WordPress plugins operate within the WordPress ecosystem as PHP-based extensions that extend site functionality; improper handling of user-supplied input in parameters can lead to script injection when the parameter value is echoed to the page without proper HTML encoding or escaping. The plugin is identified by CPE cpe:2.3:a:wproyal:royal_wordpress_backup,_restore_&_migration_plugin_-_backup_wordpress_sites_safely, indicating it is a WordPress plugin from the vendor 'wproyal'. Code review references from the WordPress plugin repository (tags/1.0.16) indicate the vulnerable code path exists in the plugin's main PHP file and associated JavaScript assets.

RemediationAI

Update the Royal WordPress Backup & Restore Plugin to version 1.0.17 or later immediately. The vendor has released a patched version; administrators should navigate to the WordPress dashboard, go to Plugins, and click 'Update' next to the Royal Backup plugin, or manually update to version 1.0.17 from the WordPress plugin repository. Verify the update completes successfully and the plugin shows version 1.0.17 or higher in the Plugins list. Until patched, limit plugin access to trusted administrators only and educate administrators not to click on suspicious links referencing backup or plugin-related URLs. Full details are available from the Wordfence vulnerability intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e0c658-b37c-4780-9589-6def9e36539b and the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Froyal-backup-reset/tags/1.0.16&new_path=%2Froyal-backup-reset/tags/1.0.17.