CVE-2026-15283 Overview
CVE-2026-15283 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPvivid Backup for MainWP plugin for WordPress. The flaw affects all versions up to and including 0.9.33. It stems from insufficient input sanitization and output escaping in the plugin's admin settings interface [CWE-79].
Authenticated attackers with administrator-level permissions can inject arbitrary web scripts. Injected scripts execute whenever a user accesses an affected page. The vulnerability only impacts multi-site installations and installations where unfiltered_html has been disabled.
Critical Impact
Authenticated administrators on WordPress multi-site installations can inject persistent JavaScript payloads that execute in the browsers of other users viewing plugin pages.
Affected Products
- WPvivid Backup for MainWP plugin for WordPress
- All versions up to and including 0.9.33
- WordPress multi-site installations and installations with unfiltered_html disabled
Discovery Timeline
- 2026-07-10 - CVE-2026-15283 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-15283
Vulnerability Analysis
The WPvivid Backup for MainWP plugin fails to properly sanitize input and escape output within its admin settings. An attacker with administrator privileges can supply JavaScript payloads through settings fields. The plugin stores these payloads and later renders them without escaping, resulting in persistent script execution in the WordPress admin context.
The issue is scoped to multi-site WordPress deployments and to single-site installations where unfiltered_html capabilities are removed. In default single-site WordPress environments, administrators legitimately possess unfiltered_html, which makes the behavior expected rather than a vulnerability. On multi-site networks, site administrators do not hold unfiltered_html by default, so injection of raw HTML or JavaScript crosses a trust boundary.
Root Cause
The plugin does not apply WordPress sanitization functions such as sanitize_text_field() on stored settings input. It also omits escaping functions such as esc_html() or esc_attr() when rendering those settings back into admin pages. This allows raw markup, including <script> tags and event-handler attributes, to be persisted and executed.
Attack Vector
An authenticated user with administrator-level access on a WordPress multi-site network submits crafted script content through the plugin's settings interface. The payload is stored in the site's database. When another privileged user, including a super administrator, later views the affected settings page, the browser executes the injected script under the admin session. This can enable session hijacking, forced configuration changes, or the creation of additional privileged accounts.
No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Change Log for source-level details.
Detection Methods for CVE-2026-15283
Indicators of Compromise
- Unexpected <script> tags, onerror, or onload attributes stored in WPvivid plugin option rows within the wp_options or site-meta tables.
- Outbound requests from admin browser sessions to unfamiliar domains when viewing MainWP dashboard pages.
- Newly created WordPress administrator or super-admin accounts without a corresponding change-management record.
Detection Strategies
- Audit plugin settings values in the database for HTML markup or JavaScript syntax that should not be present in configuration fields.
- Review WordPress audit logs for administrator-level edits to WPvivid Backup for MainWP settings.
- Inspect browser Content Security Policy violation reports for admin page loads.
Monitoring Recommendations
- Monitor wp-admin HTTP traffic for anomalous POST requests to WPvivid plugin endpoints originating from administrator accounts.
- Alert on modifications to sensitive WordPress capabilities and user roles across multi-site networks.
- Track plugin version inventory to identify sites still running WPvivid Backup for MainWP 0.9.33 or earlier.
How to Mitigate CVE-2026-15283
Immediate Actions Required
- Update WPvivid Backup for MainWP to a version later than 0.9.33 on all WordPress sites, prioritizing multi-site networks.
- Review all administrator and super-administrator accounts and remove any that are not required.
- Inspect plugin settings pages and clear any stored values containing HTML or JavaScript.
Patch Information
A fix is referenced in the plugin's changeset repository. See the WordPress Plugin Change Log for the specific commit resolving the input sanitization and output escaping issue. Apply the vendor update through the WordPress plugin manager.
Workarounds
- Restrict administrator accounts on multi-site networks to trusted operators only until the patch is deployed.
- Deactivate WPvivid Backup for MainWP on affected multi-site installations if an immediate update is not possible.
- Enforce a strict Content Security Policy on wp-admin to block inline script execution originating from stored settings.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
