VulnSocial

CVE-2026-4305Disclosure

LOWCVSS 6.1 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_template' parameter in all versions up to, and including, 1.0.16 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-04-10); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-04-10: 2Mentions · 2026-04-11: 1Mentions · 2026-04-19: 1PoC Mentioned / Linked · 2026-04-19: 1Technical Details · 2026-04-10: 204-1004-1104-19
Signal classification3 categories
Disclosure
250.0%
General
125.0%
PoC
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-04-102
Disclosure2
2026-04-111
General1
2026-04-191
PoC1
Full discourse4 posts
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-4305-royal-backup-reset-version-1-0-16-medium-vulnerability-proof-of-concept CVE-2026-4305 #WordPress plugin #vulnerability royal-backup-reset #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge

    Post summary

    The post shares a link to a proof‑of‑concept for CVE‑2026‑4305 affecting the Royal Backup Reset WordPress plugin, offering no exploit details, patches, or evidence of active exploitation.

    0000050
    6 followersView on X
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-4305 📊 Severity: 6.1 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4305 #CVE-2026-4305 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/btmRbcqBnn

    Post summary

    A tweet announces CVE-2026-4305 with a medium severity score affecting WordPress, but it offers no technical details, exploit information, or patch guidance.

    0000038
    123 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-4305 The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_template' parameter in all version… https://www.cve.org/CVERecord?id=CVE-2026-4305

    Post summary

    The post announces CVE‑2026‑4305, a reflected XSS vulnerability in the Royal WordPress Backup & Restore Plugin, providing the affected parameter but no evidence of exploitation or fixes.

    00000110
    57.0K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-4305 Reflected Cross-Site Scripting in Royal WordPress Backup & Restore Plugin 1.0.16 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4305

    Post summary

    The text announces CVE‑2026‑4305 as a reflected XSS flaw in Royal WordPress Backup & Restore Plugin 1.0.16, offering only basic technical details without any mention of PoC, exploit code, active attacks, or patches.

    0000034
    4.0K followersView on X

Explore more

Back to dashboard