Multiple Plugins - Cross-Site Scripting From Third-party Library
CVE-2023-1119

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
WP-optimize
Srbtranslatin
Vendor
CVE Published:
10 July 2023

Summary

The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.

Affected Version(s)

SrbTransLatin 0 < 2.4.1

WP-Optimize 0 < 3.2.13

References

https://wpscan.com/vulnerability/2e78735a-a7fc-41fe-8284-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Paolo Elia
WPScan
.