CVE-2023-0087 in Swifty Page Manager Plugin
Summary
by MITRE • 01/05/2023
The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-0087 resides within the Swifty Page Manager plugin for WordPress, specifically affecting versions up to and including 3.0.1. This represents a critical security flaw that exploits the plugin's handling of user input through the 'spm_plugin_options_page_tree_max_width' parameter. The issue manifests as a stored cross-site scripting vulnerability that enables attackers to inject malicious scripts into the WordPress environment. The vulnerability's impact is particularly concerning because it requires only administrator-level permissions or higher to exploit, making it accessible to users who already possess significant control over the affected system. This weakness directly violates fundamental web security principles and demonstrates inadequate input validation mechanisms within the plugin's codebase.
The technical exploitation of this vulnerability occurs through insufficient input sanitization and output escaping practices within the plugin's code. When an authenticated administrator or user with equivalent privileges submits data through the 'spm_plugin_options_page_tree_max_width' parameter, the plugin fails to properly sanitize or validate the input before storing it in the database. Subsequently, when this stored data is rendered in the web interface, the plugin does not adequately escape the output, allowing malicious scripts to execute in the context of other users' browsers. This creates a persistent threat where the injected code remains active until manually removed from the database, affecting any user who accesses pages containing the malicious content. The vulnerability's classification aligns with CWE-79, which describes cross-site scripting flaws resulting from insufficient output escaping, and demonstrates how improper input validation can lead to severe security consequences.
The operational impact of CVE-2023-0087 extends beyond simple script injection, as it enables attackers to potentially compromise entire WordPress installations through the exploitation of administrative privileges. This vulnerability affects multi-site WordPress installations and environments where the unfiltered_html capability has been disabled, which are common configurations in enterprise and managed hosting environments. Attackers could leverage this flaw to execute malicious code that could steal session cookies, redirect users to phishing sites, modify content, or even establish persistent backdoors within the WordPress environment. The attack vector is particularly dangerous because it requires minimal privilege escalation beyond existing administrative access, making it an attractive target for attackers who have already gained some level of system control. This vulnerability also aligns with ATT&CK technique T1548.001, which covers privilege escalation through abuse of application permissions, as it allows for code execution within the context of elevated user privileges.
Organizations affected by this vulnerability should immediately implement multiple layers of mitigation strategies to protect their WordPress installations. The primary recommendation involves updating to the latest version of the Swifty Page Manager plugin where the vulnerability has been addressed through proper input sanitization and output escaping mechanisms. Additionally, administrators should review and restrict user permissions to minimize the attack surface, ensuring that only essential personnel have administrative access to WordPress installations. Network-based protections such as web application firewalls and content filtering systems can provide additional defense-in-depth measures to detect and block malicious script injection attempts. Regular security audits of WordPress plugins and themes should be conducted to identify similar vulnerabilities in other third-party components. The vulnerability also underscores the importance of implementing proper input validation and output escaping practices throughout the application lifecycle, aligning with security standards such as those outlined in the OWASP Top Ten and NIST cybersecurity guidelines for web application security.