CVE-2026-15283 is a stored cross-site scripting vulnerability in the WPvivid Backup for MainWP plugin for WordPress, affecting versions up to and including 0.9.33. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of admin settings input. Authenticated attackers with administrator privileges can inject arbitrary web scripts that execute when users visit the injected pages. This vulnerability impacts multi-site WordPress installations and installations where the unfiltered_html capability is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with administrator-level access can inject malicious scripts into admin settings that persist and execute in the context of users visiting affected pages. This can lead to partial compromise of confidentiality and integrity of data within the affected WordPress environment. The vulnerability does not affect availability. The impact is limited to multi-site installations or those with unfiltered_html disabled, reducing the overall attack surface.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or limiting use of the WPvivid Backup for MainWP plugin in multi-site environments or where unfiltered_html is disabled. Applying strict input validation and output escaping in custom configurations may help mitigate risk but is not a substitute for an official fix.