CVE-2023-5738: WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-11-27 · updated 2026-06-17
Weakness: CWE-79

Description

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.

Affected products

WebToffee WordPress Backup & Migration: before 1.4.4 — fixed in 1.4.4

How to fix

Upgrade to a fixed version: WebToffee WordPress Backup & Migration 1.4.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7f935916-9a1a-40c7-b6d8-efcc46eb8eaf
https://wpscan.com/vulnerability/7f935916-9a1a-40c7-b6d8-efcc46eb8eaf

Get alerted when CVE-2023-5738 or the next vulnerability affects your stack