The Royal WordPress Backup & Restore Plugin for WordPress contains a reflected cross‑site scripting flaw caused by inadequate validation of the wpr_pending_template parameter in all versions up to and including 1.0.16. Malicious input supplied via this parameter is echoed back into page content without proper escaping, allowing an attacker to execute arbitrary JavaScript in an administrator’s browser. This can enable cookie theft, session hijacking, or site defacement.

All releases of the Royal WordPress Backup & Restore Plugin distributed by wproyal, under the name Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely, until the release of version 1.0.17, are vulnerable. Administrators who are currently using any of these affected versions should push the update as soon as possible.

The CVSS score for this vulnerability is 6.1, which indicates a moderate severity. An attacker does not need authentication; any user who receives a crafted link containing the wpr_pending_template parameter can trigger the flaw. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, but the straightforward web‑based attack path means the risk remains real for sites that have not applied the latest patch.