EUVD-2026-42791
GHSA-rqrj-mfh4-2x3m
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Aligns with NVD vector: AC:H captures non-default config requirement, PR:H reflects mandatory admin credentials, S:C reflects cross-user script execution, no availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored Cross-Site Scripting in the WPvivid Backup for MainWP WordPress plugin (all versions up to and including 0.9.33) allows authenticated administrators to inject persistent malicious scripts via plugin settings fields, which then execute in any user's browser upon visiting an affected page. Exploitation is constrained to WordPress multi-site environments or single-site installs where the unfiltered_html capability has been explicitly disabled, and requires an attacker to already hold administrator-level credentials. No public exploit code has been identified at time of analysis, and the CVSS 4.4 Medium score reflects both the high privilege bar and the specialized deployment conditions required.
Technical ContextAI
The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) of the stored variant, affecting the WPvivid Backup for MainWP plugin, which integrates the WPvivid backup system with the MainWP multi-site management framework for WordPress. The root cause is insufficient input sanitization on administrator-facing settings fields combined with missing output escaping when those stored values are rendered into page content. The CVSS scope change (S:C) reflects that scripts injected by an administrator are subsequently served to and executed by other users' browsers, crossing the security boundary from the privileged admin panel into unprivileged user sessions. The AC:H metric captures the conditional nature of the flaw: it is only exploitable in WordPress multi-site installations or in single-site installs explicitly configured with unfiltered_html disabled, both of which are non-default for standard WordPress deployments. The plugin has no CPE string supplied in the available data, but is identified by its WordPress plugin slug wpvivid-backup-mainwp at version 0.9.33 and below.
RemediationAI
An upstream code fix has been committed to the WordPress plugin SVN repository (changeset 3047890, viewable at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3047890%40wpvivid-backup-mainwp&new=3047890%40wpvivid-backup-mainwp); however, a specific named release version incorporating this commit has not been independently confirmed from the available data - update to the latest available version from the WordPress plugin directory and verify the installed version is newer than 0.9.33 by checking the plugin changelog before deployment. As a compensating control for environments that cannot update immediately, restrict administrator account access using strong multi-factor authentication and audit which accounts hold the WordPress administrator role. In single-site installs, re-enabling the unfiltered_html capability for trusted administrator accounts would eliminate the exploitable condition, though this trades the XSS risk for the broader risks of allowing raw HTML input - evaluate that trade-off against the local threat model. In multi-site environments, review network-level administrator accounts carefully, as these have the widest blast radius.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today