EUVD-2026-13927Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (val parameter) in the update_kbd_bkup_alias AJAX action in all versions up to, and including, 2.1.2. This is due to insufficient input sanitization and output escaping. While sanitize_text_field() strips HTML tags on save, it does not encode double quotes. The backup titles are output in HTML attribute contexts without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via attribute injection that will execute whenever another administrator views the backup list page.
AnalysisAI
The Keep Backup Daily WordPress plugin versions up to 2.1.2 contain a Stored Cross-Site Scripting (XSS) vulnerability in the backup title alias functionality due to insufficient input sanitization and output escaping. Authenticated administrators can inject arbitrary JavaScript via the val parameter in the update_kbd_bkup_alias AJAX action, which executes when other administrators view the backup list page. With a CVSS score of 4.4 and moderate real-world risk due to high privilege requirements, this vulnerability requires administrator-level access to exploit but can compromise other administrator sessions.
Technical ContextAI
The vulnerability stems from improper handling of user input in the Keep Backup Daily plugin (CPE: cpe:2.3:a:fahadmahmood:keep_backup_daily:*:*:*:*:*:*:*:*), classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin uses sanitize_text_field() on the val parameter during the AJAX action update_kbd_bkup_alias, which strips HTML tags but fails to encode double quotes. Critically, the backup title is subsequently rendered in HTML attribute contexts without using WordPress's esc_attr() function. This combination of weak input sanitization (allowing quote characters to pass through) and missing output escaping creates a classic attribute injection vector, allowing attackers to break out of the intended attribute context and inject event handlers or other executable code that executes in the DOM.
RemediationAI
Upgrade the Keep Backup Daily plugin to version 2.1.3 or later, which should address the input sanitization and output escaping issues. Until an update is available or deployable, limit administrator role assignments to only trusted users and implement WordPress user role management to restrict who can access backup functionality. Additionally, enforce strong password policies and enable two-factor authentication on all administrator accounts to reduce the risk of unauthorized administrator access. Monitor the WordPress plugin repository and Wordfence threat intelligence feed for the official patch release at https://www.wordfence.com/threat-intel/vulnerabilities/id/18a4fa4b-5c99-4347-8b34-e49f7e0972be?source=cve.
More in Keep Backup Daily
View allUnauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily
The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in vers
The Keep Backup Daily WordPress plugin versions up to 2.1.1 contain a limited path traversal vulnerability in the `kbd_o
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today