The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to store malicious JavaScript into content handled by the XM‑Backup plugin. Once stored, the script executes in the browsers of any user who views the affected content, potentially exposing session cookies, defacing sites, or enabling further attacks. The weakness is a CSRF flaw (CWE‑352) that is escalated to a stored XSS vector.

All WordPress sites using Xavier Media’s XM‑Backup plugin with versions up to and including 0.9.1 are vulnerable. No specific patch version is listed, but the issue applies to every installation of the plugin at or below this version.

The CVSS score of 7.1 indicates a high impact if exploited. However, the EPSS score of less than 1% shows that the likelihood of current exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to lure a logged‑in user, likely an administrator, to an authenticated request that injects the malicious payload. Once the payload is stored, any visitor to the compromised content will trigger the script. The risk is concentrated on sites that allow content editing via the plugin without proper CSRF checks.