WordPress Plugin Vulnerabilities

Migration, Backup, Staging – WPvivid < 0.9.90 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affects Plugins

Plugin icon
wpvivid-backuprestore
Fixed in 0.9.90

References

CVE
CVE-2023-5120

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.4 (medium)

Miscellaneous

Original Researcher
Ivan Kuzymchak
Verified
No
WPVDB ID
b6130985-58d4-4a9a-a8c0-62dcb3e0a50b

Timeline

Publicly Published
2023-09-22 (about 2 years ago)
Added
2023-10-20 (about 2 years ago)
Last Updated
2023-10-20 (about 2 years ago)

Other

Published
Title
Published
2026-03-14
Title
Ultra Addons for Contact Form 7 < 3.5.37 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-10-14
Title
URLYar <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2016-08-22
Title
Akal Theme - Reflected Cross-Site Scripting (XSS)
Published
2021-08-10
Title
Two Factor Authentication < 1.0.8 - Reflected Cross-Site Scripting
Published
2025-01-30
Title
Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting