CVE-2026-3577: Keep Backup Daily XSS Vulnerability

CVE-2026-3577 Overview

The Keep Backup Daily plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.1.2. The flaw resides in the update_kbd_bkup_alias AJAX action, which processes the backup title alias through the val parameter. The plugin uses sanitize_text_field() for input handling, but this function does not encode double quotes. Backup titles are later rendered in HTML attribute contexts without esc_attr(), enabling attribute injection. Authenticated attackers with Administrator-level access can inject arbitrary JavaScript that executes when another administrator views the backup list page [CWE-79].

Critical Impact
Authenticated administrators can inject persistent JavaScript that executes in the browsers of other administrators viewing the backup list, enabling session theft, account takeover, or further privileged actions.

Affected Products

Keep Backup Daily WordPress plugin versions up to and including 2.1.2
WordPress sites using the vulnerable plugin with multiple administrator accounts
Affected files: inc/functions.php and inc/kbd_cron.php

Discovery Timeline

2026-03-21 - CVE-2026-3577 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-3577

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the backup alias feature of the Keep Backup Daily plugin. The update_kbd_bkup_alias AJAX handler accepts a val parameter representing a backup title. The plugin sanitizes this input using WordPress's sanitize_text_field(), which strips HTML tags but preserves double-quote characters.

When the stored alias is later rendered, it is placed inside an HTML attribute without being passed through esc_attr(). An attacker can supply a payload containing a double quote to break out of the attribute and inject event handlers such as onmouseover or onfocus. The injected script executes in the context of any administrator who loads the backup list page.

Exploitation requires Administrator privileges, which limits the attack surface. However, the stored payload persists across sessions and triggers in a privileged context, making it useful in multi-admin environments or as a stage in account compromise chains.

Root Cause

The root cause is mismatched sanitization and output encoding. sanitize_text_field() is appropriate for normalizing text input but is not a substitute for context-specific output escaping. Because backup aliases are rendered inside HTML attributes, the plugin must call esc_attr() at output time to encode quotes and other attribute-breaking characters. The omission of this escaping in inc/functions.php and inc/kbd_cron.php allows attribute injection.

Attack Vector

An authenticated administrator sends a crafted request to the update_kbd_bkup_alias AJAX endpoint with a val payload containing double quotes and JavaScript event handlers. The payload is stored in the database. When another administrator visits the backup list page, the unsanitized alias is reflected into an HTML attribute, and the injected script executes with that administrator's session context. See the Wordfence Vulnerability Analysis for the technical breakdown.

No verified public exploit code is available. The vulnerability mechanism is documented in the WordPress Plugin Code Review at line 626 of functions.php and line 505 of kbd_cron.php.

Detection Methods for CVE-2026-3577

Indicators of Compromise

Backup alias values in the WordPress database containing double quotes, angle brackets, or JavaScript event handler strings such as onerror=, onmouseover=, or onload=
POST requests to admin-ajax.php with action=update_kbd_bkup_alias and unusual or encoded val parameter content
Unexpected outbound requests from administrator browsers shortly after loading the Keep Backup Daily admin pages

Detection Strategies

Review WordPress access logs for AJAX calls to the update_kbd_bkup_alias action originating from administrator accounts
Query the plugin's database tables for stored alias fields containing characters such as ", <, or = that would not appear in legitimate backup names
Inspect rendered HTML on the backup list page for malformed attributes or injected event handlers

Monitoring Recommendations

Enable WordPress audit logging to track administrator-level changes to plugin settings and backup metadata
Monitor browser-side errors and Content Security Policy (CSP) violation reports from administrator sessions
Alert on creation of new administrator accounts or unexpected privilege changes following plugin interaction

How to Mitigate CVE-2026-3577

Immediate Actions Required

Update the Keep Backup Daily plugin to a version newer than 2.1.2 once a patched release is available from the vendor
Audit existing backup alias entries in the database and remove any values containing HTML or JavaScript syntax
Review administrator accounts and remove any that are unnecessary to reduce the pool of users who can both inject and trigger the payload

Patch Information

A fix is referenced in the WordPress Plugin Changeset for the Keep Backup Daily plugin. Site administrators should upgrade to the fixed release as soon as it is published in the WordPress plugin directory. Confirm the installed version after upgrade through the WordPress admin dashboard.

Workarounds

Deactivate the Keep Backup Daily plugin until a patched version is installed and replace its functionality with an alternative backup solution
Enforce least privilege by limiting Administrator role assignments and using lower-privileged roles where possible
Deploy a Web Application Firewall (WAF) rule that blocks requests to admin-ajax.php where action=update_kbd_bkup_alias and the val parameter contains ", <, or > characters

bash

# Example ModSecurity rule to block attribute injection in the val parameter
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026357701,\
  msg:'CVE-2026-3577 Keep Backup Daily XSS attempt'"
  SecRule ARGS:action "@streq update_kbd_bkup_alias" "chain"
    SecRule ARGS:val "@rx [\"<>]" "t:none"