CVE-2023-0087: 
WordPress vulnerability analysis and mitigation

CVE-2023-0087 affects the Swifty Page Manager WordPress plugin versions up to and including 3.0.1. The vulnerability was discovered on December 14, 2022, and was officially published on January 5, 2023. This security issue involves a Stored Cross-Site Scripting (XSS) vulnerability that affects WordPress installations, particularly in multi-site configurations and systems where unfiltered_html has been disabled (WPScan).

The vulnerability exists due to insufficient input sanitization and output escaping in the 'spm_plugin_options_page_tree_max_width' parameter. The security flaw specifically manifests in the plugin's settings handling mechanism, where certain configuration options are not properly sanitized or escaped before being stored or displayed (CVE Mitre). The vulnerability has been assigned a CVSS score of 5.5 (Medium) (Wordfence).

The vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page. This is particularly concerning in multi-site installations and environments where unfiltered_html has been disabled (CVE Mitre).