Stored Cross-Site Scripting Vulnerability in Swifty Page Manager Plugin for WordPress
CVE-2023-0087

5.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Swifty Page Manager
Vendor
CVE Published:
5 January 2023

Summary

The Swifty Page Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting through the ‘spm_plugin_options_page_tree_max_width’ parameter, primarily due to inadequate input validation and output sanitization. This vulnerability allows authenticated users, with administrative privileges, to insert malicious web scripts into web pages. Such scripts will execute whenever an innocent user accesses the affected page. This issue specifically impacts multi-site setups and installations where the 'unfiltered_html' feature is disabled, emphasizing the need for vigilant input and output handling in web applications.

Affected Version(s)

Swifty Page Manager * <= 3.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/swifty-page-ma...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Wotschka
.