The Royal WordPress Backup, Restore & Migration Plugin (versions up to 1.0.16) contains a reflected XSS vulnerability due to improper neutralization of input in the 'wpr_pending_template' parameter. This allows unauthenticated attackers to inject malicious scripts that execute when an administrator clicks a crafted link. The vulnerability is identified as CWE-79 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No patch or official remediation level has been provided by the vendor as of the published date.

Successful exploitation can lead to limited confidentiality and integrity impacts by executing arbitrary scripts in the context of an administrator's browser session. This could allow attackers to perform actions with the administrator's privileges or steal sensitive information accessible to the administrator. There is no impact on availability reported. The vulnerability requires user interaction (clicking a link) and targets administrators specifically.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on suspicious links related to the affected plugin. Monitoring for updates from the vendor or plugin author is recommended to apply any forthcoming patches promptly.