CVE-2023-5120 in WPvivid Plugin
Summary
by MITRE • 10/25/2023
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The CVE-2023-5120 vulnerability affects the WPvivid plugin for WordPress, specifically versions up to and including 0.9.89, presenting a critical stored cross-site scripting flaw that undermines web application security. This vulnerability resides within the plugin's migration, backup, and staging functionality, which are essential components for WordPress site management and data handling. The flaw stems from inadequate input sanitization and insufficient output escaping mechanisms when processing image file path parameters, creating a persistent vector for malicious code injection that can compromise user sessions and execute unauthorized scripts.
The technical exploitation of this vulnerability occurs through authenticated administrative access, requiring attackers to possess valid administrative credentials within the WordPress environment. Once authenticated, attackers can manipulate the image file path parameter to inject malicious JavaScript code that gets stored within the application's database or configuration files. This stored payload executes whenever legitimate users access pages containing the injected content, making the vulnerability particularly dangerous as it can affect multiple users over time without requiring repeated exploitation attempts. The vulnerability maps directly to CWE-79, which identifies cross-site scripting flaws in web applications, and represents a classic case of insufficient input validation combined with inadequate output sanitization.
The operational impact of CVE-2023-5120 extends beyond simple script execution, as it can enable attackers to escalate privileges, steal session cookies, redirect users to malicious sites, or even gain complete control over compromised WordPress installations. Since the vulnerability affects core backup and migration functionality, attackers could potentially manipulate backup processes or staging environments to propagate malicious code across multiple system components. This makes the vulnerability particularly dangerous for organizations relying on automated backup processes or those maintaining staging environments that mirror production systems. The attack vector aligns with ATT&CK technique T1566.001, which describes the use of malicious file uploads or script injection to establish persistent access.
Mitigation strategies for this vulnerability require immediate patching of the WPvivid plugin to version 0.9.90 or later, which includes proper input sanitization and output escaping mechanisms. Organizations should also implement network segmentation and access controls to limit administrative privileges, ensuring that only trusted personnel can access WordPress administrative interfaces. Regular security audits of installed plugins and themes should be conducted to identify similar vulnerabilities, while implementing content security policies can provide additional defense-in-depth measures. Additionally, monitoring for suspicious administrative activities and implementing web application firewalls can help detect and prevent exploitation attempts. The vulnerability demonstrates the critical importance of maintaining up-to-date software components and proper input validation practices in web application security.