Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting
CVE-2023-2122

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Image Optimizer By 10web
Vendor
CVE Published:
16 August 2023

Summary

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.

Affected Version(s)

Image Optimizer by 10web 0 < 1.0.27

References

https://wpscan.com/vulnerability/936fd93a-428d-4744-a4fc-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phạm Ngọc Khánh
WPScan
.