WordPress Royal WordPress Backup & Restore Plugin plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter vulnerability

Reflected Cross-Site Scripting via 'wprpendingtemplate' Parameter vulnerability discovered by Abi Wiranata in WordPress Plugin Royal WordPress Backup, Restore & Migration versions = 1.0.16...

EUVD-2026-21260

The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wprpendingtemplate' parameter in all versions up to, and including, 1.0.16 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject...

CVE-2026-4305 Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter

The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wprpendingtemplate' parameter in all versions up to, and including, 1.0.16 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject...