CVE-2026-3577 is a stored cross-site scripting vulnerability in the Keep Backup Daily WordPress plugin by fahadmahmood. It affects all versions up to and including 2.1.2. The issue is due to improper neutralization of input in the 'val' parameter of the 'update_kbd_bkup_alias' AJAX action. Although the plugin uses sanitize_text_field() to strip HTML tags on save, it does not encode double quotes, and the backup titles are output in HTML attribute contexts without esc_attr(), enabling attribute injection. Only authenticated users with Administrator-level privileges or higher can exploit this vulnerability to inject arbitrary scripts that execute when other administrators view the backup list page.

An attacker with Administrator-level access can inject malicious scripts into backup title aliases, which will execute in the context of other administrators viewing the backup list. This can lead to limited confidentiality and integrity impact, such as session hijacking or unauthorized actions performed by the victim administrator. The CVSS score of 4.4 reflects a medium severity with network attack vector, high attack complexity, and no user interaction required.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and consider monitoring for suspicious activity related to backup title modifications. Avoid using the vulnerable plugin version in production environments if possible.