CVE-2026-3577 Details
Description
The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (`val` parameter) in the `update_kbd_bkup_alias` AJAX action in all versions up to, and including, 2.1.2. This is due to insufficient input sanitization and output escaping. While `sanitize_text_field()` strips HTML tags on save, it does not encode double quotes. The backup titles are output in HTML attribute contexts without `esc_attr()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via attribute injection that will execute whenever another administrator views the backup list page.
A stored cross-site scripting vulnerability has been identified in the Keep Backup Daily plugin for WordPress, affecting all versions through 2.1.2. The issue arises in the 'update_kbd_bkup_alias' AJAX action, where the backup title alias parameter lacks proper input sanitization and output escaping. Although 'sanitize_text_field()' removes HTML tags when saving, it fails to encode double quotes. Consequently, backup titles are rendered in HTML attribute contexts without using 'esc_attr()', allowing authenticated attackers with Administrator-level access to inject arbitrary web scripts via attribute injection. These scripts execute when another administrator views the backup list page.
Users are advised to update the Keep Backup Daily WordPress plugin to version 2.1.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 21, 2026CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Keep Backup Daily | <= 2.1.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 21, 2026 | New CVE Received | [email protected] |