Stored Cross-Site Scripting Vulnerability in Swifty Page Manager Plugin for WordPress

CVE-2023-0087

What is CVE-2023-0087?

The Swifty Page Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting through the ‘spm_plugin_options_page_tree_max_width’ parameter, primarily due to inadequate input validation and output sanitization. This vulnerability allows authenticated users, with administrative privileges, to insert malicious web scripts into web pages. Such scripts will execute whenever an innocent user accesses the affected page. This issue specifically impacts multi-site setups and installations where the 'unfiltered_html' feature is disabled, emphasizing the need for vigilant input and output handling in web applications.

References