Lucene search
WPScanCVELIST:CVE-2023-2113HistoryMay 30, 2023 - 7:49 a.m.
CVE-2023-2113 Autoptimize < 3.1.7 - Admin+ Stored Cross-Site Scripting via Settings Import
2023-05-3007:49:13
WPScan
www.cve.org
autoptimize
wordpress
plugin
security
issue
vulnerability
cross-site scripting
admin panel
multisite.
0.001 Low
EPSS
Percentile
23.7%
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Autoptimize",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "3.1.7"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
cve
cve
CVE-2023-2113
2023-05-30 08:15:09
prion
prion
Design/Logic Flaw
2023-05-30 08:15:00
nvd
nvd
CVE-2023-2113
2023-05-30 08:15:09
openvas
openvas
WordPress Autoptimize Plugin < 3.1.7 XSS Vulnerability
2023-06-07 00:00:00