PT-2026-26723 · Fahad Mahmood · Keep Backup Daily

San6051 · Published 2026-03-20 · Updated 2026-03-21 · CVE-2026-3577

Mitre

CVSS v3.1

4.4

Medium

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (val parameter) in the update kbd bkup alias AJAX action in all versions up to, and including, 2.1.2. This is due to insufficient input sanitization and output escaping. While sanitize text field() strips HTML tags on save, it does not encode double quotes. The backup titles are output in HTML attribute contexts without esc attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via attribute injection that will execute whenever another administrator views the backup list page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3577

Affected Products

Keep Backup Daily

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3577 · Security Note
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L626 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3481587%40keep-backup-daily&new=3481587%40keep-backup-daily&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/trunk/inc/functions.php#L626 · Note
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/trunk/inc/kbd_cron.php#L505 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/18a4fa4b-5c99-4347-8b34-e49f7e0972be?source=cve · Note
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/kbd_cron.php#L505 · Note