CVE-2026-4305

Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.1
CVSS Score
6.1
CVSS Score
medium
Severity
1.0.17
Patched in
1d
Time to patch

Description

The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_template' parameter in all versions up to, and including, 1.0.16 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=1.0.16
PublishedApril 9, 2026
Last updatedApril 10, 2026
Affected pluginroyal-backup-reset

What Changed in the Fix

Changes introduced in v1.0.17

Loading patch diff...

Source Code

WordPress.org SVN
Research Plan
Unverified

This research plan outlines the steps to verify the Reflected Cross-Site Scripting (XSS) vulnerability in the Royal WordPress Backup & Restore Plugin (CVE-2026-4305). ### 1. Vulnerability Summary * **Vulnerability:** Reflected Cross-Site Scripting (XSS) * **Parameter:** `wpr_pending_template` (…

Show full research plan

This research plan outlines the steps to verify the Reflected Cross-Site Scripting (XSS) vulnerability in the Royal WordPress Backup & Restore Plugin (CVE-2026-4305).

1. Vulnerability Summary

  • Vulnerability: Reflected Cross-Site Scripting (XSS)
  • Parameter: wpr_pending_template (via GET)
  • Vulnerable Version: <= 1.0.16
  • Sink: The plugin echoes the wpr_pending_template parameter directly into the HTML of an admin page (likely the plugin dashboard or a notice on the plugins page) without proper sanitization or escaping using functions like esc_attr() or esc_html().
  • Context: This vulnerability is triggered during the plugin's activation flow or when navigating the plugin's admin pages.

2. Attack Vector Analysis

  • Endpoint: /wp-admin/admin.php?page=royal-backup-reset or /wp-admin/plugins.php
  • Payload Parameter: wpr_pending_template
  • Authentication: Requires an Administrator to click a malicious link (Unauthenticated attacker, Administrator victim).
  • Preconditions: The Royal WordPress Backup & Restore Plugin must be installed and active.

3. Code Flow

  1. The function royalbr_maybe_skip_activation_redirect() (in royal-backup-reset.php) is hooked to fs_redirect_on_activation_royal-backup-reset.
  2. It checks for the presence of $_GET['wpr_pending_template'].
  3. While this specific function only returns false to prevent a redirect, the logic that "resumes" the template edit flow (as described in the code comments) subsequently retrieves this parameter from the $_GET superglobal.
  4. The value is then outputted to the page (the "sink") to either populate a JavaScript variable for redirection or to display a "pending" status message/link to the administrator.
  5. Since the parameter is not passed through esc_html, esc_attr, or esc_url before output, arbitrary HTML/JavaScript injected into the parameter is executed by the browser.

4. Nonce Acquisition Strategy

Reflected XSS vulnerabilities in GET parameters typically do not require a nonce because the vulnerability lies in the rendering of the page, not in a state-changing action that requires CSRF protection. The security context is provided by the administrator's active session.

  • Bypass: No nonce is required for this specific exploit.

5. Exploitation Strategy

The goal is to demonstrate that an arbitrary script can be executed in the context of the WordPress admin.

  • Payload: "><script>alert(document.domain)</script>
  • Target URL: http://[TARGET_IP]/wp-admin/admin.php?page=royal-backup-reset&wpr_pending_template=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E

Step-by-Step:

  1. Login: Use browser_navigate to authenticate as an administrator.
  2. Navigation: Navigate to the plugin dashboard with the malicious parameter appended to the URL.
  3. Observation: Use http_request to capture the raw HTML and verify the payload is reflected unescaped.
  4. Verification: Use browser_eval to check if the alert/script was executed.

6. Test Data Setup

  • User: An administrator account (default: admin / password).
  • Plugin: Royal WordPress Backup & Restore Plugin (slug: royal-backup-reset) version 1.0.16 installed and activated.
  • Commands:
    wp plugin install royal-backup-reset --version=1.0.16 --activate
    

7. Expected Results

  • The HTTP response from the server should contain the raw string "><script>alert(document.domain)</script>.
  • When viewed in a browser, the script should execute, triggering an alert box or other observable JavaScript behavior.

8. Verification Steps (Post-Exploit)

Since this is a reflected XSS (non-persistent), there are no database changes to verify. Verification is done by checking the response body of the HTTP request:

  1. Perform a GET request using http_request.
  2. Search the response body for the specific string:
    # Conceptually:
    grep "<script>alert(document.domain)</script>" response_body.html
    
  3. Confirm that the reflection is not escaped (i.e., it is not &lt;script&gt;).

9. Alternative Approaches

If the reflection does not occur on the page=royal-backup-reset dashboard, it may occur on the main plugins.php page if the plugin triggers a notice upon activation/resume:

  • Alternative URL: /wp-admin/plugins.php?wpr_pending_template=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

If the sink is inside a JavaScript string (e.g., var redirect = '...';):

  • JS-Breakout Payload: ';alert(1);//
  • Target URL: /wp-admin/admin.php?page=royal-backup-reset&wpr_pending_template=%27%3Balert(1)%3B%2F%2F
Research Findings
Static analysis — not yet PoC-verified

Summary

The Royal WordPress Backup & Restore Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_template' GET parameter in versions up to 1.0.16. This occurs because the plugin fails to sanitize or escape the parameter before echoing it back into the administrative dashboard, allowing arbitrary script execution when an administrator clicks a malicious link.

Vulnerable Code

// royal-backup-reset/royal-backup-reset.php line 26
add_filter( 'fs_redirect_on_activation_royal-backup-reset', 'royalbr_maybe_skip_activation_redirect' );

/**
 * Conditionally prevents Freemius activation redirect during template edit flow.
 *
 * @since 1.0.0
 * @param bool $redirect Whether to redirect.
 * @return bool False to prevent redirect, original value otherwise.
 */
// royal-backup-reset/royal-backup-reset.php line 34
function royalbr_maybe_skip_activation_redirect( $redirect ) {
	// Check if we're returning from a template edit flow.
	// The wpr_pending_template parameter now contains the edit URL (not just "1").
	if ( isset( $_GET['wpr_pending_template'] ) || get_transient( 'wpr_pending_template_edit' ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		return false; // Prevent redirect.
	}
	return $redirect;
}

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/royal-backup-reset/1.0.16/readme.txt /home/deploy/wp-safety.org/data/plugin-versions/royal-backup-reset/1.0.17/readme.txt
--- /home/deploy/wp-safety.org/data/plugin-versions/royal-backup-reset/1.0.16/readme.txt	2026-02-24 08:43:54.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/royal-backup-reset/1.0.17/readme.txt	2026-03-03 11:04:18.000000000 +0000
@@ -1,36 +1,44 @@
-=== Royal WP Backup, Restore and Database Reset - Website Backups made Easy ===
+=== Royal Wordpress Backup & Restore Plugin - Backup Wordpress Sites Safely ===
 Contributors: wproyal
-Tags: backup, cloud backup, database backup, restore, reset database
-Stable tag: 1.0.16
+Tags: backup plugin, wordpress backup, database backup, restore, reset database
+Stable tag: 1.0.17
 Requires at least: 5.0
 Tested up to: 6.9.1
 Requires PHP: 7.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
-Create a WP Website backups easy and Restore whenever you need. Schedule automatic backups, Cloud Backups, Database backup. Built in database reset tool.
+WordPress backup plugin to create full website backups and restore them easily, smart pre-update backup reminders, built-in database reset tool and more!
 
 == Description ==
 
-https://www.youtube.com/watch?v=4SZ9r8mOt1M
+Royal Backup & Restore is a powerful and **easy-to-use** WordPress backup plugin that helps you protect your website by creating full site backups, database backups, and automatic scheduled backups in just a few clicks. Whether you want to secure your website from crashes, plugin conflicts, hacking attempts, or update failures, this plugin ensures your WordPress site can always be **restored quickly and safely**.
+
+Unlike other WordPress backup plugins, Royal Backup includes a **unique smart** backup reminder system that **automatically prompts** you to create a backup before updating plugins, themes, or installing new ones — preventing accidental data loss.
 
-Royal Backup, Restore & Reset is a comprehensive WordPress plugin that provides complete backup, restore, and WP reset functionality for your WordPress website. Whether you need to create regular website backups, migrate your site, or database reset, this plugin has you covered.
+With Royal Backup, you can create complete WordPress backups including database, plugins, themes, uploads, and wordpress core files (PRO version), then restore your website instantly with one-click restore. The plugin also supports automatic backup scheduling (PRO version), allowing you to run hourly, daily, weekly, or monthly backups without manual effort.
+
+You can also securely store backups in **cloud storage** (PRO version) such as Google Drive, Dropbox, and Amazon S3, manage multiple backup locations, and perform selective backup and restore operations. Additionally, the built-in database reset tool lets you instantly reset WordPress to a fresh state without reinstalling.
 
 🚀 Visit Plugin [Homepage](https://royal-elementor-addons.com/royal-backup-reset/?ref=rea-wpo-pp-details-tab)
 
 = ✅Key Features of Free Version =
 
-* **Unique Feature - Backup Notification During Theme or Plugin Updates or Installation - No other plugin offers this feature** - ⏩ [See Video](https://www.youtube.com/watch?v=4SZ9r8mOt1M&t=27s). Plugin will remind you to make backup before activating or updating themes or plugins
+* **Unique Feature - Backup Notification During Theme or Plugin Updates or Installation - No other plugin offers this feature** - ⏩ [See Video](https://www.youtube.com/watch?v=4SZ9r8mOt1M&t=27s). Plugin will remind you to make wordpress backup before activating or updating themes or plugins
 * **Full Website Backups** - Backup your entire WordPress website including database, plugins, themes, uploads, and other files
 * **Full Website Restore** - Restore your entire WordPress website including database, plugins, themes, uploads, and other files
-* **Assign Custom Names to your Backups** - Assign custom names to backups for easy identification and organization.
-* **Backup Component Downloads** - Download individual backup components such as the database, plugins, themes, and more.
-* **Background Backup** - Feel free to refresh or close the browser window during backups — this won’t break the backup process.
-* **Backup & Restore Progress Tracking** - Real-time progress updates during backup and restore operations
-* **Database Reset** - Reset your WordPress database to a fresh installation - You do not need to reinstall WP, simple one click and your WP reverts to original fresh state.
+* **Assign Custom Names to your Backups** - Assign custom names to wordpress backups for easy identification and organization.
+* **Backup Component Downloads** - Download individual wordpress backup components such as the database, plugins, themes, and more.
+* **Background Backup** - Feel free to refresh or close the browser window during wordpress backups — this won’t break the backup process.
+* **Backup & Restore Progress Tracking** - Real-time progress updates during wordpress backup and restore operations
+* **Database Reset** - Reset your WordPress database to a fresh installation - You do not need to reinstall Wordpress, simple one click and your Wordpress reverts to original fresh state.
 * **Backup Management Simple User interface** - View, download, restore, and delete website backups from a simple interface
 
-= 🌟Royal Backup PRO Version - Key Features =
+= ✅Video overview of Backup Notification During Theme or Plugin Updates =
+
+https://www.youtube.com/watch?v=4SZ9r8mOt1M
+
+= 🌟Key Features of PRO Version =
 
 https://www.youtube.com/watch?v=toQF4kf02nU
 
@@ -44,9 +52,9 @@
 * **Selective Backup** - Choose specific components to backup — such as the database, plugins, themes, WordPress core files, or uploads — individually.
 * **Selective Restore** - Choose specific components to restore - such as the database, plugins, themes, WordPress core files, or uploads — individually.
 * **Backup Rename** - Rename your backups to improve identification, organization, and management.
-* **Customizable Defaults** - Save your preferred backup and restore settings as defaults — so you don’t need to preselect them every time you perform a backup or restore.
+* **Customizable Defaults** - Save your preferred Wordpress backup and restore settings as defaults — so you don’t need to preselect them every time you perform a backup or restore.
 * **Incremental Backups (Coming Soon)** - Backup only the files and folders that have changed since your last backup, saving both time and storage space.
-* **Wordpress Multisite Network Support (Coming Soon)** - Full support for WordPress Multisite networks, all WP Multisite files and databases will be stored in the backup.
+* **Wordpress Multisite Network Support (Coming Soon)** - Full support for WordPress Multisite networks, all Wordpress Multisite files and databases will be stored in the backup.
 * **Clear Uploads Directory** - Perform a full cleanup of the uploads folder during a database reset for a completely fresh start.
 * **Priority Support** - Get direct support from the developers whenever you need help with your backups.
 
@@ -73,22 +81,22 @@
 
 = WordPress Admin Method =
 
- 1. Go to you administration area in WordPress `Plugins > Add`
+ 1. Go to your administration area in WordPress `Plugins > Add`
  2. Look for `Royal Backup` (use search form)
  3. Click on Install and activate the plugin
  4. After activating Royal Backup plugin you will see it in the admin dashboard menu with the name Royal Backup
  5. Create your first backup using the "Create Backup" tab > Select what to include in the backup, Press "Start Backup Process" Button
  6. To Restore your backup navigate to Restore Site section, choose backup to restore and press Restore button
- 7. To Delete your backup navigate to Restore Site section and press Remove button. This will completle remove all backups files and folders. This action can't be undone
+ 7. To Delete your backup navigate to Restore Site section and press Remove button. This will completely remove all backups files and folders. This action can't be undone
 
 = FTP Method =
 
 1. Upload the `royal-backup-reset` folder to the `/wp-content/plugins/` directory
 2. Activate the Royal Backup, Restore & Reset plugin through the 'Plugins' menu in WordPress
-3. In the WP appearance menu go to in Royal Backup to start using the plugin
+3. In the Wordpress appearance menu go to in Royal Backup to start using the plugin
 4. Create your first backup using the "Create Backup" tab > Select what to include in the backup > Press "Start Backup Process" Button
-5. To Restor your backup navigate to Restore Site section, choose backup to restore and press Restore button
-6. To Delete your backup navigate to Restore Site section and press Remove button. This will completle remove all backups files and folders. This action can't be undone
+5. To Restore your backup navigate to Restore Site section, choose backup to restore and press Restore button
+6. To Delete your backup navigate to Restore Site section and press Remove button. This will completely remove all backups files and folders. This action can't be undone
 
 
 
@@ -96,7 +104,7 @@
 
 = How to create My First Website Backup? =
 
-Navigate in Plugin main Menu - Look for "Royal Backup" Name in your WP admin dashboard, Navigate to "Create Backup" tab > Select what to include in the backup > Press "Start Backup Process" Button. Congratulations your first website backup is created.
+Navigate in Plugin main Menu - Look for "Royal Backup" Name in your Wordpress admin dashboard, Navigate to "Create Backup" tab > Select what to include in the backup > Press "Start Backup Process" Button. Congratulations your first website backup is created.
 
 = How to restore my Website Backup? =
 
@@ -117,11 +125,11 @@
 * Plugins folder
 * Themes folder
 * Uploads folder (Where images, videos and similar files are stored)
-* WP Core files (Only In PRO Version)
+* Wordpress Core files (Only In PRO Version)
 
 = Is it safe to reset my database? =
 
-This feature is mainly for testers or for those who want to reset WP to fresh install and Start from Scratch. The database reset feature will delete all your Content and Settings. Your current user account will be preserved. **Always create a backup before resetting!**
+This feature is mainly for testers or for those who want to reset Wordpress to fresh install and Start from Scratch. The database reset feature will delete all your Content and Settings. Your current user account will be preserved. **Always create a backup before resetting!**
 
 == Screenshots ==
 
@@ -133,6 +141,9 @@
 6. Mini Database Reset Icon
 
 == Changelog ==
+= 1.0.17 =
+* Minor Improvements.
+
 = 1.0.16 =
 * Performance Improvements.
 

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/royal-backup-reset/1.0.16/royal-backup-reset.php /home/deploy/wp-safety.org/data/plugin-versions/royal-backup-reset/1.0.17/royal-backup-reset.php
--- /home/deploy/wp-safety.org/data/plugin-versions/royal-backup-reset/1.0.16/royal-backup-reset.php	2026-02-24 08:43:54.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/royal-backup-reset/1.0.17/royal-backup-reset.php	2026-03-03 11:04:18.000000000 +0000
@@ -4,7 +4,7 @@
  * Plugin URI: http://wordpress.org/plugins/royal-backup-reset/
  * Description: Complete backup, restore and reset functionality for WordPress websites.
  * Author: wproyal
- * Version: 1.0.16
+ * Version: 1.0.17
  * Requires at least: 5.0
  * Requires PHP: 7.4
  * Tested up to: 6.9.1
@@ -207,7 +207,7 @@
 
 // Set plugin version for asset cache busting and compatibility checks.
 if ( ! defined( 'ROYALBR_VERSION' ) ) {
-	define( 'ROYALBR_VERSION', '1.0.16' );
+	define( 'ROYALBR_VERSION', '1.0.17' );
 }
 
 // Initialize plugin-wide constants including paths and configuration.

Exploit Outline

The exploit targets the plugin's dashboard or activation flow by injecting a malicious payload into the 'wpr_pending_template' GET parameter. 1. Target URL: An attacker crafts a URL such as `http://[site]/wp-admin/admin.php?page=royal-backup-reset&wpr_pending_template="><script>alert(document.domain)</script>`. 2. Delivery: The attacker tricks an authenticated administrator into clicking this link, often via a phishing email or a malicious site. 3. Execution: When the administrator's browser loads the page, the plugin logic retrieves the `wpr_pending_template` value. Because the plugin subsequently reflects this value into the HTML response (e.g., inside a status message or JavaScript variable) without escaping, the `<script>` tag is rendered and executed in the context of the administrator's session. 4. Impact: The script can then perform administrative actions on the site, such as creating a new administrator user or stealing session cookies.

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.