WordPress Plugin Vulnerabilities

BackWPup < 5.7.5 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some data before outputting it back in a page, leading to a Stored Cross-Site Scripting vulnerability which can be exploited by unauthenticated attackers to inject arbitrary web scripts that will execute when a user views the affected page.

Affects Plugins

Plugin icon
backwpup
Fixed in 5.7.5

References

CVE
CVE-2026-65443
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2dfd592b-cbe9-460a-8b9a-148058d1bd58

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
245d918f-fa54-4f6a-903c-846895397f9c

Timeline

Publicly Published
2026-07-27 (about 2 months ago)
Added
2026-07-30 (about 2 months ago)
Last Updated
2026-07-30 (about 2 months ago)

Other

Published
Title
Published
2026-07-07
Title
Property Hive < 2.2.4 - Unauthenticated Stored Cross-Site Scripting
Published
2025-01-16
Title
One Backend Language <= 1.0 - Reflected Cross-Site Scripting
Published
2025-03-03
Title
AFI < 1.100.0 - Admin+ Stored XSS
Published
2026-04-21
Title
Real Estate Pro <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings
Published
2025-08-15
Title
Surbma | Recent Comments Shortcode < 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting