Reflected XSS Vulnerability in Backup and Staging by WP Time Capsule
CVE-2025-47477

7.1HIGH

Key Information:

Vendor

WordPress
Status
Backup And Staging By WP Time Capsule
Vendor
CVE Published:
9 June 2025

What is CVE-2025-47477?

A vulnerability exists in the Backup and Staging plugin by WP Time Capsule that allows an attacker to execute malicious scripts in users' browsers via reflected cross-site scripting (XSS). This occurs when the inputted data is not properly sanitized during web page generation, allowing attackers to manipulate request parameters. Users of versions up to 1.22.23 should assess their exposure and implement mitigative measures promptly.

Affected Version(s)

Backup and Staging by WP Time Capsule <= 1.22.23

References

https://patchstack.com/database/wordpress/plugin/wp-time-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trương Hữu Phúc (truonghuuphuc) (Patchstack Alliance)
.