CVE-2023-5120: Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated Stored Cross-Site Scripting
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-5120?
CVE-2023-5120 is a vulnerability in the Migration, Backup, Staging – WPvivid plugin for WordPress that allows authenticated attackers to perform stored cross-site scripting attacks.
What is the severity of CVE-2023-5120?
The severity of CVE-2023-5120 is medium with a CVSS score of 4.4.
How does CVE-2023-5120 work?
CVE-2023-5120 works by exploiting insufficient input sanitization and output escaping in the image file path parameter of the WPvivid plugin, allowing authenticated attackers to inject and execute malicious scripts.
Which versions of the WPvivid plugin are affected by CVE-2023-5120?
Versions up to and including 0.9.89 of the WPvivid plugin are affected by CVE-2023-5120.
How can CVE-2023-5120 be fixed?
To fix CVE-2023-5120, users should update to a version of the WPvivid plugin that is not affected by the vulnerability, implement input validation and output encoding, and follow security best practices.