The Backwp plugin contains a flaw in which it does not properly neutralize user input when generating a web page, allowing attackers to inject malicious scripts that execute in the victim’s browser. This reflected cross‑site scripting vulnerability can expose session cookies, deface content, or redirect victims to malicious sites. The weakness is classified as CWE‑79 and exists only in how the plugin handles user‑supplied data, without affecting other components.

Any WordPress site that has the Backwp plugin installed with a version up to and including 2.0.2 is affected. The vulnerability covers all releases from the plugin’s inception through v2.0.2, regardless of specific minor revisions.

The CVSS score of 7.1 indicates a moderate severity. The EPSS score of less than 1% suggests a very low chance of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to visit a crafted URL or interaction that triggers the plugin’s output, after which malicious JavaScript runs in the victim’s browser. The attack surface is limited to users who engage with the vulnerable plugin’s rendered content.