The vulnerability is an improper neutralization of input during web page generation that allows reflected cross‑site scripting. An attacker can supply malicious script via request parameters that is echoed back to the browser, enabling the execution of arbitrary javascript in the context of the site. This can lead to cookie theft, session hijacking, or defacement of the site.

The issue affects the NickDuncan Nifty Backups plugin for WordPress. Versions from the earliest release up to and including 1.08 are vulnerable, as the flaw exists in all releases up to 1.08.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS payload injected through the plugin's web interface, requiring an affected user to visit a crafted URL or interact with vulnerable input. The vulnerability could be exploited by an attacker who can lure the target to a malicious link or by compromising a site that serves the vulnerable plugin to visitors.