CVE-2023-5121 in WPvivid Plugin
Summary
by MITRE • 10/25/2023
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-5121 affects the WPvivid plugin for WordPress, specifically targeting the migration, backup, and staging functionalities. This stored cross-site scripting flaw exists in versions up to and including 0.9.89, representing a significant security risk for WordPress installations that utilize this plugin. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's administrative settings, particularly concerning the backup path parameter. Security researchers have classified this issue under CWE-79 which represents Cross-Site Scripting vulnerabilities, specifically highlighting the stored nature of the flaw where malicious scripts are permanently stored on the server and executed when users access affected pages.
The technical implementation of this vulnerability exploits the plugin's handling of user-supplied input within administrative configuration settings. When administrators configure backup paths through the plugin's interface, the input validation processes fail to properly sanitize the data before it is stored in the database. This allows authenticated attackers with administrator-level privileges or higher to inject malicious JavaScript code into the backup path parameter. The vulnerability specifically impacts multi-site WordPress installations where the unfiltered_html capability has been disabled, creating a scenario where legitimate administrative functions become vectors for code execution. The flaw operates because the plugin does not adequately escape output when rendering these stored parameters in administrative contexts, enabling the execution of malicious scripts in the browsers of any user who accesses affected pages.
The operational impact of CVE-2023-5121 extends beyond simple script injection, as it provides attackers with a persistent foothold within the WordPress environment. Since the vulnerability requires only administrator-level access, attackers who have already compromised admin credentials can leverage this flaw to execute arbitrary code across multiple sites within the network. The stored nature of the XSS vulnerability means that the malicious scripts remain active even after the initial injection, continuously affecting any user who accesses pages containing the compromised backup path data. This makes the vulnerability particularly dangerous in multi-site environments where a single compromised administrator account could enable attacks across an entire network of interconnected WordPress installations. The impact is further amplified by the fact that these scripts execute in the context of the victim's browser, potentially allowing for session hijacking, data exfiltration, and further privilege escalation attacks.
Mitigation strategies for CVE-2023-5121 should prioritize immediate plugin updates to versions that address the input sanitization and output escaping deficiencies. Organizations should implement strict access controls and monitor administrator activities for any suspicious configuration changes that might indicate exploitation attempts. The principle of least privilege should be enforced, limiting administrative capabilities to only those users who require such access for legitimate operational purposes. Security teams should also consider implementing content security policies that restrict script execution within WordPress administrative interfaces. Additionally, regular security audits of installed plugins and themes should be conducted to identify other potential vulnerabilities that might be exploited in similar fashion, as this vulnerability demonstrates the importance of proper input validation and output escaping practices. The ATT&CK framework categorizes this type of vulnerability under T1547.009 for Cloud API abuse and T1059.007 for Scripting, highlighting the need for comprehensive monitoring and response capabilities that can detect and prevent such exploitation patterns in enterprise environments.