The vulnerability allows an attacker who holds Administrator or higher privileges on a WordPress site to inject arbitrary scripts via the backup title alias field during the AJAX update_kbd_bkup_alias operation. The input is stored without proper escaping, particularly missing esc_attr() when outputting the title in an HTML attribute. When another administrator views the backup list page, the injected script runs in the context of that admin’s browser session, enabling cookie theft, session hijacking, or further compromise within the site.

All copies of the Keep Backup Daily WordPress plugin through version 2.1.2 are affected. The issue exists in the backup title alias handling in the plugin’s AJAX interface. Sites running any of these versions should check the plugin version and update if possible.

The CVSS score of 4.4 indicates moderate risk. The lack of an EPSS score means the current likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Since the flaw requires authenticated access, the risk primarily applies to sites with administrators who can alter backup titles. An attacker with such privileges could exploit the stored XSS by uploading a malicious backup title, causing client‑side compromise whenever another admin accesses the backup list page.